₦airaland Forum

Am working on the registration page of a webapp and i need the query statement i'll be using for the "testcode" parameter i.e. if the code exists in the database, then it should register, else fail.

The way it was inserted is

$query = "update test set testname='" . htmlspecialchars($_REQUEST['testname'], ENT_QUOTES) . "',testdesc='" . htmlspecialchars($_REQUEST['testdesc'], ENT_QUOTES) . "',subid=" . htmlspecialchars($_REQUEST['subject'], ENT_QUOTES) . ",testfrom='" . $fromtime . "',testto='" . $totime . "',duration=" . htmlspecialchars($_REQUEST['duration'], ENT_QUOTES) . ",totalquestions=" . htmlspecialchars($_REQUEST['totalqn'], ENT_QUOTES) . ",testcode=ENCODE('" . htmlspecialchars($_REQUEST['testcode'], ENT_QUOTES) . "','oespass') where testid=" . $_REQUEST['testid'] . ";";

I tried

$result=executeQuery("select testcode from test where testcode=DECODE('" . htmlspecialchars($_REQUEST['testcode'], ENT_QUOTES) . "';";
if(mysql_num_rows($result1) != 0)
    {
        $_GLOBALS['message']="Sorry the Testcode doesn't exist.";
    }
else
{
 //Register
}

but it didn't work.

Someone should please help. Thanks

Hmm! let me finish eating and concentrate to solve your problem soon!

Thank you. .

Lemme simplify the problem now, the main problem is in this line, around that decode line.

$result=executeQuery("select testcode from test where testcode=DECODE('" . htmlspecialchars($_REQUEST['testcode'], ENT_QUOTES) . "';";

I want it to encode the user's input. .and check against what i have in my db.

I can see you didn't close your quote properly. Look at your lines they are not in accordance with what you want them to do for you. Just look closely you will see what the errors are.

Thanks for all the efforts. Solved already.

Post the solution, to help someone someday.