PHP + MySQL problems :(

Question

Hello, I am havin trouble with this code:

if ($_GET['offline']) {$extranet = $_GET['offline'];} else {$extranet = $online;}
$sql = mysqli_query($db,"UPDATE tbl_system SET value = '$extranet' WHERE property = 'extranet'");
echo $_GET['offline'];
echo $extranet;
echo $online;

In the database, the value of the field where the property = extranet is 1. Results of echo:

$_GET['offline'] = 0 $extranet = 1 $online = 1

Now, obviously, something's wrong here.

The URL to give this GET is: ?app=admincp&offline=0, so $_GET['offline'] is not the problem.

The problem must lie in the if statement, but I can't figure it out,

Any ideas?

Answer 1

if ($_GET['offline'])

That will return false because the string "0" evaluates to false in PHP, so the if statement's condition can never evaluate to true. Use isset or array_key_exists instead. e.g.:

if (isset($_GET['offline'])) { ... }

or:

if (array_key_exists('offline',$_GET)) { ... }

In your case, you'll want to know whether or not the value is exactly the string zero "0". I would recommend using strcmp:

if (strcmp($_GET['offline'],"0") === 0) {
    $extranet = $_GET['offline'];
} else {
    $extranet = $online;
}
$sql = mysqli_query($db,"UPDATE tbl_system SET value = '$extranet' WHERE property = 'extranet'");
echo $_GET['offline'];
echo $extranet;
echo $online;

Answer 2

$_GET['offline'] is zero in the URL you provide, so if($_GET['offline']) and everything in that block will never be hit. Use isset() instead.

Answer 3

$_GET['offline'] is 0, and 0 evaluates to false, so the statement goes right. if you want to check whether offline is passed as an argument you have to use isset()

if (!isset($_GET['offline'])) {$extranet = $_GET['offline'];} else {$extranet = $online;}

Answer 4

Yikes! In addition to karim's comment- sanitize your inputs! You're taking a URL parameter and putting it directly into an SQL query. A url of

?app=admincp&offline=';DROP table tbl_system;--

Would ruin you!

Answer 5

if (strcmp($_GET['offline'],"0") === 0) {
    $extranet = $_GET['offline'];
} else {
    $extranet = $online;
}

This will throw an error in the case that $_GET['offline'] is not set, better to use !isset($_GET['offline'])