Member Avatar for Riu 2009

hi everyone :)
i know how to show all the records from database in an html table but how would i show specific category.for example i want to show records only with type T (type T is in database).im new with php and i dont know how to do it properly.thankyou here is my code

<?php include("../includes/config.php"); ?>
<!DOCTYPE HTML>
<html>
<head>
<title>Admdin Home</title>
<link rel="StyleSheet" href="css/style.css" type="text/css" media="screen">
</head>
<body>
<?php include("includes/header.php"); ?>
<?php include("includes/nav.php"); ?>
<?php include("includes/aside.php"); ?>
<div id="maincontent">

    <div id="breadcrumbs">
        <a href="">Home</a> >
        <a href="">Manage Users</a> >
        List Users
    </div>
    <h2>Teachers List</h2>
</div>
<?php
 if ($_SESSION["isadmin"])
   {

   $con=mysql_connect($dbserver,$dbusername,$dbpassword);
if (!$con)
    {
   die('Could not connect: ' . mysql_error());

    }



mysql_select_db($dbname, $con);
$result = mysql_query("SELECT * FROM accounts WHERE (type=='T')");
echo "<table border='1'>
<tr>
<th>E-mail</th>
<th>Firstname</th>
<th>Lastname</th>
<th>Type</th>
</tr>";

while($row = mysql_fetch_array($result))
  {
  echo "<tr>";
    echo "<td>" . $row['email'] . "</td>";
  echo "<td>" . $row['firstname'] . "</td>";
  echo "<td>" . $row['lastname'] . "</td>";
    echo "<td>" . $row['type'] . "</td>";
  echo "</tr>";
  }
echo "</table>";

mysql_close($con);
?>

</body>
<?php include("includes/footer.php"); ?>
</html>
<?php
    }
    else
    {
        header("Location: ".$fullpath."login/unauthorized.php");

    }
?>
  • 2 Contributors
  • 2 Replies
  • 2K Views
  • 15 Hours Discussion Span
  • Latest Post Latest Post by Riu 2009

Dani AI

Generated

is spot-on about the comparison operator. Since you are filtering by a single category, it is also a good time to modernize the DB access so this code runs on current PHP. The old mysql_* API was removed in PHP 7+, so it will fail on most hosts today. Use PDO (or MySQLi) with a prepared statement, limit the columns you select, and escape output before echoing it into the page.

<?php
$pdo = new PDO(
    "mysql:host=$dbserver;dbname=$dbname;charset=utf8mb4",
    $dbusername,
    $dbpassword,
    [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
     PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC]
);

$type = 'T'; // if this ever comes from input, whitelist: ['T','S','A'] etc.
$sql = "SELECT email, firstname, lastname, type
        FROM accounts
        WHERE type = :type
        ORDER BY lastname, firstname";
$stmt = $pdo->prepare($sql);
$stmt->execute([':type' => $type]);

echo "<table border='1'><tr><th>E-mail</th><th>Firstname</th><th>Lastname</th><th>Type</th></tr>";
foreach ($stmt as $row) {
    echo "<tr>";
    echo "<td>" . htmlspecialchars($row['email'], ENT_QUOTES, 'UTF-8') . "</td>";
    echo "<td>" . htmlspecialchars($row['firstname'], ENT_QUOTES, 'UTF-8') . "</td>";
    echo "<td>" . htmlspecialchars($row['lastname'], ENT_QUOTES, 'UTF-8') . "</td>";
    echo "<td>" . htmlspecialchars($row['type'], ENT_QUOTES, 'UTF-8') . "</td>";
    echo "</tr>";
}
echo "</table>";

A few extras that will save you time later:

  • If you filter by type often, add an index on that column.
  • Consider renaming the column from type to role (or use backticks in queries) to avoid confusion with generic names.
  • Your $_SESSION['isadmin'] check is good, . Also ensure the DB user has least-privilege rights (read-only for listing pages).

Recommended Answers

All 2 Replies

Member Avatar for Atli

In MySQL queries, you only use one = char to compare values, not two.

SELECT ... WHERE type = 'T'

Also, you should always check database results before trying to use them. That way, errors like the one above will be much easier to debug. For example:

$sql = "SELECT invalid query";
$result = mysql_query($sql);
if (!$result) {
    trigger_error("MySQL query failed: " . mysql_error(), E_USER_ERROR);
}

And, while I'm already at it, the mysql_query family of functions - the old MySQL API extension - is deprecated and really shouldn't be used. Instead use PDO or MySQLi.

Edited by Atli
Member Avatar for Riu 2009

thankyou very much for the additional info thts really helpful thanks again :)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.