Error: Undefined index

Question

I have this code and you give me the following mistake:

Notice: Undefined index: ID in

<?
require('../members/inc/config.php');
require('../lib/framework.php');

// load the configuration file.
$newsid = $_GET['ID'];

$stmt = $db->query("SELECT * FROM news ORDER BY id = '$newsid' ");
while($myrow = $stmt->fetch(PDO::FETCH_ASSOC)) {

               //now print the results:
               echo "<b>Title: ";
               echo $myrow['Title'];
               echo "</b><br>On: <i>";
               echo $myrow['Date'];
               echo $myrow['Embed'];
               echo "</i><hr align=left width=160>";
               echo $myrow['Hour'];

               // Now print the options to (Read,Edit & Delete the news)
               echo "<br><a href=\"testonho.php?newsid=$myrow[ID]\">Read More...</a>
                || <a href=\"edit_news.php?newsid=$myrow[ID]\">Edit</a>
                 || <a href=\"delete_news.php?newsid=$myrow[ID]\">Delete</a><br><hr>";

             }//end of loop

?> 

I have seen other issues related to this error here on Stackoverflow and I didn’t really find what I wanted. I would like a help to the resolution to this my problem :

Answer 1

There’s a mistake in $myrow[ID] on the three lines of links that form the HTML. The correct should be $myrow['ID']. And it needs to encapsulate between keys because it’s a complex expression. So:

echo "<br><a href=\"testonho.php?newsid={$myrow['ID']}\">Read More...</a>
            || <a href=\"edit_news.php?newsid={$myrow['ID']}\">Edit</a>
             || <a href=\"delete_news.php?newsid={$myrow['ID']}\">Delete</a><br><hr>";

I put in the Github for future reference.

With the new information passed in comment of how the first call is being made it becomes clear that it needs one more change. Line 6 needs to be switched to:

$newsid = $_GET['newsid'];

In addition, it has a beautiful vulnerability that can allow SQL Injection but not related to the reported problem.

Answer 2

It seems that your code is not expressing your idea is to display only one record, use WHERE clause no select.

$stmt = $db->query("SELECT * FROM news WHERE id = '$newsid' ORDER BY id");

To avoid sql Injection use Prepared statements, it does not change the code much, a step is added to the process:

$sql = 'SELECT * FROM news '; 

 if(!empty($newsid){// caso tenha um id exibe somente ele
    $sql .= ' WHERE id = ? ORDER BY id';
 }    

$stmt = $db->prepare($sql);
$stmt->execute(array($newsid)); // aqui faz o bind da interrogação com $newsid
$itens = $stmt->fetchAll(PDO::FETCH_ASSOC); //retorna todas as linhas de uma vez.

foreach($itens as $myrow){
   echo ....
}

To receive parameters by the url, you need to use the same name defined in the link, e.g.: seusite.com? newsid=ID_DA_NOTICIA, you should call it so

 $newsid = $_GET['newsid'];

and not $_GET['ID'] For the string ID not defined in link.