Pages (4):    1 2 3 4
Member
Member
Sabyre   09-09-2010, 23:02
#31

Got it...

added:
`
$sqlalbumid = mysql_query("SELECT id, folder FROM zp_albums WHERE folder ='" . $album . "'");
$albumid = mysql_fetch_array( $sqlalbumid );
if (strcasecmp($album, $albumid['folder']) 0) {
echo "Album folder " .$album. " does NOT exist, please check the spelling.";
}

else {
`

Member
Member
kagutsuchi   10-09-2010, 00:04
#32

Two notes:

The code you posted is not secure. You really should be sanitizing anything that comes through $_POST. It's probably also not safe against XSRF attacks, though I'm not too familiar with that subject.

I see a lot of mysql_query() in your code; it's probably better to compile one long query in your code and then, at the end, actually query the database. (I don't really have experience with databases, but I'm speaking from a coding standpoint.)

Pages (4):    1 2 3 4
  
Powered By MyBB, © 2002-2026 MyBB Group.
Made with by Curves UI.