{"action":"created","issue":{"url":"https://api.github.com/repos/digitalmethodsinitiative/dmi-tcat/issues/91","labels_url":"https://api.github.com/repos/digitalmethodsinitiative/dmi-tcat/issues/91/labels{/name}","comments_url":"https://api.github.com/repos/digitalmethodsinitiative/dmi-tcat/issues/91/comments","events_url":"https://api.github.com/repos/digitalmethodsinitiative/dmi-tcat/issues/91/events","html_url":"https://github.com/digitalmethodsinitiative/dmi-tcat/issues/91","id":58062367,"number":91,"title":"Problem with dataset","user":{"login":"psegovias","id":5105474,"avatar_url":"https://avatars.githubusercontent.com/u/5105474?v=3","gravatar_id":"","url":"https://api.github.com/users/psegovias","html_url":"https://github.com/psegovias","followers_url":"https://api.github.com/users/psegovias/followers","following_url":"https://api.github.com/users/psegovias/following{/other_user}","gists_url":"https://api.github.com/users/psegovias/gists{/gist_id}","starred_url":"https://api.github.com/users/psegovias/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/psegovias/subscriptions","organizations_url":"https://api.github.com/users/psegovias/orgs","repos_url":"https://api.github.com/users/psegovias/repos","events_url":"https://api.github.com/users/psegovias/events{/privacy}","received_events_url":"https://api.github.com/users/psegovias/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-02-18T12:36:26Z","updated_at":"2015-02-19T09:45:25Z","closed_at":null,"body":"I made a custom php file, to UPDATE some row on database, its based on form with values.\r\n\r\nI require this files:\r\n\r\nrequire_once '../config.php';\r\nrequire_once 'common/config.php';\r\nrequire_once 'common/functions.php';\r\n\r\n\r\nand validate all variables with:\r\nvalidate_all_variables();\r\n\r\nThe update its something like this:\r\n\r\n$sql = \"UPDATE \" . $esc['mysql']['dataset'] . \"_tweets SET value = '\" . $_POST['value'] . \"' WHERE `id` = \" . $_GET['id'];\r\n        $sqlresults = mysql_query($sql);   \r\n        echo $sql;\r\n\r\nAnd this is the problem, i cant get the correct dataset, any idea?\r\n\r\nRegards!\r\n"},"comment":{"url":"https://api.github.com/repos/digitalmethodsinitiative/dmi-tcat/issues/comments/75022938","html_url":"https://github.com/digitalmethodsinitiative/dmi-tcat/issues/91#issuecomment-75022938","issue_url":"https://api.github.com/repos/digitalmethodsinitiative/dmi-tcat/issues/91","id":75022938,"user":{"login":"ErikBorra","id":927284,"avatar_url":"https://avatars.githubusercontent.com/u/927284?v=3","gravatar_id":"","url":"https://api.github.com/users/ErikBorra","html_url":"https://github.com/ErikBorra","followers_url":"https://api.github.com/users/ErikBorra/followers","following_url":"https://api.github.com/users/ErikBorra/following{/other_user}","gists_url":"https://api.github.com/users/ErikBorra/gists{/gist_id}","starred_url":"https://api.github.com/users/ErikBorra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ErikBorra/subscriptions","organizations_url":"https://api.github.com/users/ErikBorra/orgs","repos_url":"https://api.github.com/users/ErikBorra/repos","events_url":"https://api.github.com/users/ErikBorra/events{/privacy}","received_events_url":"https://api.github.com/users/ErikBorra/received_events","type":"User","site_admin":false},"created_at":"2015-02-19T09:45:24Z","updated_at":"2015-02-19T09:45:24Z","body":"It seems you want to run the script from your browser. \r\nFirst, make sure to escape any user-input in the database. Easiest is to do `mysql_real_escape_string($_POST['value']);` and `mysql_real_escape_string($_GET['id']);`. Better would be to check the type and values of the user input (e.g. `if(preg_match(\"/^\\d+$/\",$_GET['id']) $id = $_GET['id']; else die('id should be an integer');`. \r\nSecond, it seems you are mixing POST and GET parameters. Not bad per se, but not consistent either.\r\nThird, make sure you have a GET parameter for dataset. I.e. make sure that in your URL you also have dataset=querybinname. To verify the parameters which are passed to your script via the browser,  put `var_dump($_REQUEST);` just before `validate_all_variables()`? There should be a parameter named `dataset`."}}