Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

More than one htmlspecialchars string in PHP MySQL

Tags:

php

I have a table in MySQL where there is a row with this data.

  • id = 187
  • friendly name = i don't like mustard
  • filetype = exe

This first block of code below works perfectly, and echos text i don't like mustard into an HTML form. Similarly, if I change $row['friendlyname'] to $row['filetype'], text exe is echoed. All good, no issues yet.

<?php
$con = mysqli_connect('domain','user','pass','db');
$sql = "select * from installers where id=187";
$result = mysqli_query($con,$sql);

while($row=mysqli_fetch_array($result))
$friendlyname = htmlspecialchars(" ".$row['friendlyname']." ",ENT_QUOTES);

$con->close();
?>

<input type='text' value='<?php echo $friendlyname; ?>'>



The problem I'm having is if I try to echo both $row['friendlyname'] and $row['filetype'], only the variable that is listed first will be echoed. For example, in the below code, $row['friendlyname'] is listed before $row['filetype']. In this example, only $row['friendlyname'] (i don't like mustard) will be echoed. Similarly, if $row['filetype'] is listed before $row['friendlyname'], then only $row['filetype'] (exe) is echoed, and the second other HTML input form is empty.

<?php
$con = mysqli_connect('domain','user','pass','db');
$sql = "select * from installers where id=187";
$result = mysqli_query($con,$sql);

while($row=mysqli_fetch_array($result))
$friendlyname = htmlspecialchars(" ".$row['friendlyname']." ",ENT_QUOTES);
$filetype= htmlspecialchars(" ".$row['filetype']." ",ENT_QUOTES);

$con->close();
?>

<input type='text' value='<?php echo $friendlyname; ?>'>
<input type='text' value='<?php echo $filetype; ?>'>



Note 1: It doesn't matter the order of the input type forms. I ruled that out as the issue.
Note 2: If I were to replace $row['friendlyname'] and $row['filetype'] with the text I'm trying to echo, then it work (the below code). So, this definitely appears to be something with these $row variables.

<?php
$con = mysqli_connect('domain','user','pass','db');
$sql = "select * from installers where id=187";
$result = mysqli_query($con,$sql);

while($row=mysqli_fetch_array($result))
$friendlyname = i don't like mustard;
$filetype= exe;

$con->close();
?>

<input type='text' value='<?php echo $friendlyname; ?>'>
<input type='text' value='<?php echo $filetype; ?>'>
like image 870
JeremyCanfield Avatar asked Jan 26 '26 04:01

JeremyCanfield


1 Answers

You have not added brackets into while loop so only first record is populated.

This block:

while($row=mysqli_fetch_array($result))
$friendlyname = htmlspecialchars(" ".$row['friendlyname']." ",ENT_QUOTES);
$filetype= htmlspecialchars(" ".$row['filetype']." ",ENT_QUOTES);

Should be:

while($row=mysqli_fetch_array($result)){
   $friendlyname = htmlspecialchars(" ".$row['friendlyname']." ",ENT_QUOTES);
   $filetype= htmlspecialchars(" ".$row['filetype']." ",ENT_QUOTES);
}
like image 162
emmanuel Avatar answered Jan 27 '26 19:01

emmanuel