php page won't display the first record

986173

I have the following code, but it always skip the first row of the records pull from an Oracle table:

include "utility_functions.php";

// Form the query and execute it

$sql = "select * from dept where cid=".$_GET['q'];

$result_array = execute_sql_in_oracle ($sql);

$result = $result_array["flag"];

$cursor = $result_array["cursor"];

if ($result == false){

  display_oracle_error_message($cursor);

  die("Client Query Failed.");

}

// Display the query results

echo "<ul class=\"nav\">";

$values = oci_fetch_array ($cursor);

//echo $values[0];

// Fetch the result from the cursor one by one

while ($values = oci_fetch_array($cursor)){

  $did = $values[0];

  $dname = $values[1];

  echo("<li><a href=\"showdetail.php?did=$did\">$dname</a></li> ");

}

oci_free_statement($cursor);

echo "</ul>";

for example, I have the following in dept table:

did    dname

1     Business

2     Education

3     Math

4     English

It will only list: education, math, and english.  Any clues?

Christopher Jones-Oracle

What does execute_sql_in_oracle() do?

Try following example code, such as from:

        http://www.php.net/manual/en/oci8.examples.php

        http://www.php.net/manual/en/function.oci-fetch-array.php

        http://www.php.net/manual/en/function.oci-bind-by-name.php

It's extremely insecure (and slow) to do a query made up with string concatenation like:

  $sql = "select * from dept where cid=".$_GET['q'];

You probably need to first sanitize $_GET to remove anything malicious.  Then you must use a bind variable on the sanitized result.