s0da — Wed, 05 May 2004 03:13:08 +0000

lol no problem. that was a good laugh.

airoid3000 — Wed, 05 May 2004 02:51:57 +0000

I totally messed up the variable name. Sorry to waste your time, my error!

druagord — Tue, 04 May 2004 14:04:29 +0000

did you try

<?php
echo $username;
?>

just before the sql statement remember

<?php
$sql = \"select sum(updates) from update_track where (username=$username)\";
$username = \"toto\";
mysql_query($sql);
?>

that won't work you have to set $username before you set it in sql

Suzanne — Tue, 04 May 2004 11:33:35 +0000

Okay, then how is it getting the variable? Perhaps you have an issue elsewhere?

airoid3000 — Tue, 04 May 2004 02:18:58 +0000

FYI, it is submitting the sql statement with username being blank.

airoid3000 — Tue, 04 May 2004 01:35:07 +0000

I actually make the usernames for my clients. Therefore, they are all letters.

s0da — Tue, 04 May 2004 01:29:30 +0000

yeah cause i was thinking maybe it was the username that was causing the syntax error. possibly.

Suzanne — Tue, 04 May 2004 01:23:25 +0000

Well, lol, that's no good.

You don't want to allow just anything in! At the very least, restrict it to letters and numbers only, no other characters. Any other character will allow malicious scripting, break things, et cetera.

airoid3000 — Tue, 04 May 2004 00:46:58 +0000

Whatever the username that is logged in is. Could be anything.

s0da — Tue, 04 May 2004 00:32:11 +0000

what does the variable $username contain?

$username = "something";