PHP code checker?

mrmac

Hi folks, my last college assignment for web scripting went really well, would have gotten higher marks if one of my PHP codes had worked correctly, in different browsers. I use IE for previewing all of my web code, as it's far less forgiving than Firefox or Chrome, and until now, has never let me down!

Anyway, the HTML code is fine, (using HTML5 Doctype - no real reason) it's just when it gets to the PHP section, that things just don't happen in either Firefox or Chrome - but works as expected in IE???

Here's the entire page code ...

<?php
	require('header.php');

  	$connection = mysql_connect("localhost","root","");
 	mysql_select_db("librarydb",$connection);

	//check if a group was posted here or not
	if(isset($_POST['category']))
		$category=$_POST['category'];
	else
		$category="All";
	
	//Dropdown Box
	$result=mysql_query("SELECT DISTINCT `category` FROM books", $connection);
?>

<table>
<p>&nbsp;</p>
<h2>Books</h2>
</table>


</br>
<form name="myForm" method="post" action="books.php">
  Category:
  <select name='category'><option value='All'>All</option>";
  
    <?php
		while($row=mysql_fetch_row($result))
		{
			print("<option ");

//check if current group from the dataset is the same as the group posted here
		if($row[0]==$category)
		print("selected=`selected`");
		print("value=`");
		print($row[0]);
		print("`>");
		print($row[0]);
		print("</option>");
		}
	?>
  </select>
  <input type="submit" value="Go">
</form>

<!--------------------------------------------------------------->

</br>
<table border="1">
<tr>
<th>ISBN</th>
<th>Title</th>
<th>Author</th>
<th>Category</th>
</tr>
<?php
	//Table
	if($category=="All")
		{
			$query = "SELECT * FROM books";
		}
	else
		{
	$query = "SELECT * FROM books WHERE `category` = '".$category."'";
		}
		
	$result = mysql_query($query, $connection);	
		
	while($row = mysql_fetch_array($result))
	{
		print("<tr><td>");
		print($row["isbn"]);
		print("</td><td>");
		print($row["title"]);
		print("</td><td>");
		print($row["author"]);
		print("</td><td>");
		print($row["category"]);
		print("</td><td>");
		print("[View] [Edit] [Delete]");
		print("</td></tr>");
	}
	

mysql_close($connection);


	require('footer.php');

Nothing crazy, simple stuff, I thought!

I've been looking at this for over an hour, and I'm just not seeing the problem!
I'm using Dreamweaver as my editor, which shows no syntax errors, and all the coding has been done manually.

Any suggestions on how to validate / check my code to highlight any browser issues?

Cheers.

DonkeyStyle \o/

For what ever reason, IE is fine with you using back-ticks around the <option> value=, probably not sending them as part of the POST, where firefox sends the backticks as part of the string, so your SQL query is probably looking for a category name with backticks in it. You can see this happening if you echo the contents of $category.

Use single quotes instead and it works
[PHP]
print("value='");
print($row[0]);
print("'>");[/PHP]

awec

backticks are evil. Especially in some fonts that make them look like quotes.

MySQL used to (not sure if still does) treat backticks and apostrophes different. Just for the laughs I presume.

mrmac

Thanks DonkeyStyle \o/!
I wouldn't have got that in a million years!

New found hatred for that obscure button at the top left of my keyboard!
Yet I feel grateful for my enlightenment .......

Is there any way of automatically checking for this kind of error?
Web dev, php/javascript, databases - this is, I have discovered, what that I like the most,
so any advice or tips, on code checking, or techniques, would be very welcome.

maxmarmalade

I use Netbeans and it highlights any lines with errors. It may well pick up this kind of problem, but not 100% sure

mrmac

I'm using Dreamweaver, which highlights any syntax errors, but it didn't have any problems with the above backticks, so just wondering if there is any kind of "Code Validator" that I can run my code through to check its compatibility?

Something like the "HTML Validator" by WC3 would be great.

DonkeyStyle \o/

PHP is run on the server, so you don't need to validate it against different browsers, only the html output (and possibly the http headers) is open to cross browser differences (and you can still use the html validator for that if you view-source on the resulting page). If the PHP portion of your page runs without errors or warnings from PHP itself, then it's as "valid" as it's going to get.

What you had there was a logic problem, the code was doing exactly what you told it to, but it didn't match your intent. It just happens, and sometimes you need to troubleshoot.

You should really make it a habit to filter your inputs too, anything from the user/browser must be treated as evil. Get interested in security. Getting hacked sucks quite a lot.