Php function isnt working!

Well it kind of does..


$NewTicketType = $_POST['NEW_FK_TICKET_TYPE_ID'];
$NewTicketSubType = $_POST['NEW_FK_TICKET_SUB_TYPE_ID'];
$NewTicketID = LookUpIdById($NewTicketType,$NewTicketSubType);

echo $NewTicketID;

Now if I do that it doesnt work but if I put in
$NewTicketID = LookUpIdById(1,1); it does work...

I have already verified that $NewTicketType and NewTicketSubType are equal to 1 by echoing them too... Thoughts?

Quote:

---

Originally Posted by oofki

Thoughts?

---

Check if $NewTicketType and $NewTicketSubType actually get assigned what you've POST'ed.

Edit: oeps.. You've already checked that :rolleyes:

Yeah its really frustrating im not sure if there is a way to force a variable to be an integer because maybe it is seeing it a string and wont work?

What does that function look like (just the basics)?

You could also force the conversion to integer with $integer = intval($somestring);

Quote:

---

Originally Posted by oofki

Yeah its really frustrating im not sure if there is a way to force a variable to be an integer because maybe it is seeing it a string and wont work?

---

Does your function rely on them being integers? If so, you could use is_int (in an if statement) to verify that you have an integer and if you don't, you could use int to cast it to an integer... I forget what php considers values to be from a post.

Example int usage:

$x = "1";
$y = (int)$x;

is_int($x) is False
is_int($y) is True

Well the function looks like:

function LookUpIdById($parent_id,$child_id)
{
$where = "where PARENT_ID=$parent_id and CHILD_ID=$child_id ";
return($this->LookUpOneColumn("ID",$where));
}

It works fine if i put in the numbers but not the variables like I said I will try that int function :-)

i tried intval() and it still doesnt work!!!

Quote:

---

$where = "where PARENT_ID=$parent_id and CHILD_ID=$child_id ";

---

Because of this it shouldn't really matter if $parent_id is a string or an integer as it all gets converted to strings anyway..

Weird.. Try echo'ing the values inside the function.. See if that's different..

Okay I figured it out. Basically the subtype that I had was already the ID that would be produced by that function and I did not need to even run it :-)

Thanks for the thoughts SirDice and HtRegz :-D

Just wanna add: NEVER TRUST YOUR USER

http://www.php.net/addslashes

http://www.php.net/strip_tags

Quote:

---

Just wanna add: NEVER TRUST YOUR USER

http://www.php.net/addslashes

http://www.php.net/strip_tags

---

I find that mysql_real_escape_string works the best as no matter what they put in or how you escape things it's not going to break the query.

The other thing, is to surround the column name with ticks which means that it accepts both the int and string of a number e.g

$where = "where PARENT_ID='$parent_id' and CHILD_ID='$child_id' ";

Cheers,
Niggles

that is only part of the function anyways there are a bunch of functions in an includes function that call each other to build the queries and inserts and they are all cleaned going in and coming out

im not a big fan of sql real escape...we know that the var should not have any sql...a smple regx should tell us if there is any non expected char, just discard the bad input with a nasty response.

Quote:

---

im not a big fan of sql real escape...we know that the var should not have any sql..

---

I find it's useful for letting characters such as ' or " be entered into comment fields or in CMS backend without risk of terminating the SQL command.