代码逻辑不应允许查询通过，但它仍然执行PHP SQL

Question

I receive a $_GET['id'] from the URL - I want it only numeric if not go to a 404 page. I believe I should work - but I have new relic that tells me otherwise and im stump. (note i'm working with legacy code so I apologize for the mysql_query commands and i'm aware I should be using PDO instead)

    if(isset($_GET['item']) && is_numeric($_GET['item'])) {
        $id = $_GET['item'];
    }
    else {
        $timestamp = date("Y-m-d");
        $get_item = json_encode($_GET['item']);
        $err = date("Y-m-d").": Get Item is wrong:".$get_item."
";
        $file = "/logs/error_log_".$timestamp.".log";
        file_put_contents($file, $err, FILE_APPEND | LOCK_EX);
        header( 'Location: http://www.example.com/404.php' ) ;
    }

    $iquery = "SELECT * FROM products WHERE products_id = $id";
    $iresult = mysql_query($iquery);

    if ($iresult == false) {
        $timestamp = date("Y-m-d");
        $err = date("Y-m-d").": SQL:".$iquery."
";
        $file = "logs/error_log_".$timestamp.".log";
        file_put_contents($file, $err, FILE_APPEND | LOCK_EX);        
        header( 'Location: http://www.examples.com/404.php' ) ;
    }
    $iline = mysql_fetch_array($iresult, MYSQL_ASSOC);

according to my log the query itself receive nothign so $id receives nothing and my log file fires with nothing and new relic fires and tells me that my query is failing.

I don't get it.

Answer 1

It seems like you expect the script to stop after you call header(), but there's nothing in your code that would cause that to happen. header() just adds an HTTP header to the response; it doesn't end your script. If you only want the query to be executed when $_GET['id'] is numeric then you should do the query inside the first if block, not after the else block.