I got this error:

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in C:\wamp\www\fullc.php on line 29

I changed :

$tableid = $_GET['id'];

to

$tablecode = $_GET['code'];

and

$query  = "SELECT * FROM nmr WHERE id=$tableid";

to

$query  = "SELECT * FROM nmr WHERE code=$tablecode";

Yes.


No, but correctly indexing tables improves performances.

I can't remember your database structure (if you shared it), but you would make id your Primary key, and code could be either Indexed or Unique Indexed.
(Afaik, Unique is a constraint that prevents you INSERTing non-distinct code values, but doesn't affect SELECTing.)

Depending on other queries, you may benefit from adding other indexes/indices also - missing or incorrect indexes is a common cause of slow performance in database [web] apps.





Nope - just to be clear - indexes affect how queries run, but not what they return. (Analogy: The index in the back of a book doesn't change what a book contains, but can speed up your searching for something.)

If you're doing the parameterized queries that Matt suggested before, you will need to use %s for this instead of %d, as the latter means decimal integer and your code looks to be a string.

If code/$tablecode is a string, it needs to be quoted.


Except, if you simply wrap single quotes, I'll come and do:
http://domain/full.php?code=AT';DROP TABLE nmr;'

And kill all your data.
(well, I wouldn't, but an evil person might)


Unless of course you're just not showing the bit where you sanitize it, in which case I'm still going to shout at you - examples that don't use/show proper database sanitization mean that anyone who just copies and pastes the example will have code with bugs and security holes, which makes it easier for evil people to do bad things. :@

Right. Quoting made it work. Thanks.

 

I still need to sort out protecting my database.

 

I may just password protect the site (fail)

Depends how much you trust the rest of your group/etc?


Even if you trust them absolutely, I'd still getting into the habit of parametrising queries.

(Not sure about PHP, but with CFML the param-ing queries can further help performance as well, since it can cache one query execution plan for many queries, which is often more efficient.)



Oh, and whilst I'm thinking about it... since this is important data, you are backing up your database, right?

(Can be as simple as an automated mysqldump then zip the output and move somewhere.)

Aye. I've been taking a backup every so often. But automated would be far more useful.

 

I also handwrite each entry in my lab book :D

Well there's an assortment of examples you could use on the mysqldump manual page:
http://dev.mysql.com/doc/refman/5.1/en/mysqldump.html

Some of them rather complex, but there's some simple ones there too.

Ok! I shall have a look at that. Thanks again.

Another question (yay) :

I want an input box where I can stick my 'code' (AT052 etc), click "Go to entry" and it takes me to fullc.php?='AT052'. This one I assume is painfully easy and really does show my lack of knowledge, or more so, what to search since I've been searching lots.

Found plenty of form code for sticking a URL in a box and going to it but I want to stick part of the URL in a box.

Ended up with this:

<form name="openlocation">
<input type="text" name="code" value="AT">
<input type="button" value="Go To" onClick="document.location = "fullc.php?="'document.openlocation.code.value';; ">
</form>

(Which clearly doesn't work)

I think you've got jQuery up and running? If so, you can do:

<input type="text" id="code" value="AT"/>
<button type="button" onclick="location.href='./fullc.php?code='+$j('#code').val();">Go To</button>

If not, it's slightly longer but not too bad:

<input type="text" id="code" value="AT"/>
<button type="button" onclick="location.href='./fullc.php?code='+document.getElementById('code').value;">Go To</button>

Yay, nearly there. Just the 'code' needs to be in single quotes in the final URL.

 

Though that now seems to have broken somehow :@

No no no no no - put the single quotes around the variable in the SQL query, not inside the code variable itself!

Otherwise you're just making things much more complicated for yourself.

Fantastic. Done. Sorted. Working. :D

 

Also, don't worry, I'll be keeping you occupied with more questions in the coming weeks/months. :Y

You do terrible things with HTML tags :-((

If by "terrible things" you mean use them properly as intended, then yes.

Well, not really. In this case it's just an internal project and it clearly doesn't matter and I'm just being pedantic. But a button with an onclick to change URLs is horrible.

Hmmm... actually you're right - should have done a form with method=get instead of the onclick stuff; I was just 'fixing' what was there, rather than thinking properly. :(

Meh, it rarely matters in situations like this one. BUT YES YOU SHOULD HAVE B-)

I can't believe he's been fobbing me off with poorly thought out code :((

It always matters. :( An undisciplined mind leads to sloppy thinking, which leads to inefficiency and results in not having a new personal website for half a decade. :((

Please accept my humble apologies. :$


Here is what I should have given you:

<form action="./fullc.php" method="get">
	<input type="text" name="code" value="AT"/>
	<button type="submit">Go To</button>
</form>