Multi - Pass Demo

NOTE

Some servers report a problem with the mysql_real_escape_string function when you pass it a single integer (as I do in the showHero.php form.) When you know your expected value will be a single integer, you can use the simpler intval() function to turn the value into a simple integer. This will have the same effect: eliminating the possibility of SQL injection attacks.

The complete corrected code for showHero.php is shown below:

  <?php

//get heroID

//print_r($_REQUEST);

$heroID = $_REQUEST['heroID'];
//$heroID = mysql_real_escape_string($heroID);
$heroID = intval($heroID);

//connect to db

$db = mysql_connect("localhost","user","password") or die(mysql_error());

mysql_select_db("xfd");

//extract query
$query = "SELECT * FROM hero WHERE heroID = $heroID";
$result = mysql_query($query) or die(mysql_error());
while ($row = mysql_fetch_assoc($result)){
  foreach ($row as $name => $value){
    print "$name: $value <br />";
  }
} // end while
?>