‫So now we want to do the details page.
‫Now when I click this you'll see in the URL.
‫It says listing.
‫Let me just make this a little bigger.
‫It says listing one, which is the ID?
‫I actually want to send the ID in as a query string, at least for now.
‫So in the home view, let's go down to where the link is.
‫And we're going to do this.
‫We're going to say slash listing.
‫And then question mark ID equals and then the id.
‫So now if we go back to the home page and we click on that, you can see now the URL.
‫Is it has an ID equals two.
‫So let's create the view for this first.
‫So in views listings we're going to have a new file called show dot view dot php.
‫And a lot of this is just common convention with RESTful architecture.
‫Show is the common name for just showing a single resource.
‫If you've come from like a Ruby on Rails background, or even even coming from Laravel, it's just a
‫lot of these conventions are very similar.
‫So in the view here, we're going to want to get the theme the HTML.
‫So let's see.
‫Let me just bring this over.
‫This is my just my HTML theme.
‫And I'm going to go to the details HTML.
‫And let's see we don't want any of the the stuff that's coming in in partials.
‫Basically just want this section right here.
‫Not the bottom banner.
‫So we want to stop there.
‫Let's copy that.
‫And then let's put that in the view.
‫And we also need our partial includes.
‫So these are the bottom.
‫And then these at the top.
‫Whoops.
‫Okay, let's save that.
‫And now let's go back to the details page.
‫We have we haven't added the route yet.
‫So let's go to our routes.
‫So routes PHP and we're going to add a new route.
‫I'll just.
‫I'll just copy one of these down.
‫It's going to be a Get request to just listing later on.
‫We're going to be able to do this.
‫We're going to be able to say slash colon ID but we can't do that just yet.
‫We need to upgrade our router to handle that.
‫So for now it's just going to be listing and it's going to go to controllers listing and show dot PHP.
‫All right, now let's see.
‫Close that up and let's go into our controller and listings.
‫And let's create our show dot PHP controller.
‫And we know we're going to want to load the view.
‫So let's come down here and let's say load view.
‫And we want to pass into here listings slash show.
‫And now we should be able to know.
‫Okay, so this isn't working, but watch.
‫If I take the query string off and it goes to just listing, it is working.
‫All right.
‫And I'll tell you why in a second.
‫But let's get rid of the search.
‫We definitely don't want that on the details page or the show page.
‫So get rid of this right here.
‫Okay.
‫Now, the reason that's happening is because when when it's matching our route, it's it's even looking
‫at the query string.
‫So if I say ID equals two or whatever, let's say ID equals two, it's looking for that specific route.
‫If we go to our index.php.
‫So public index.php it's looking at it right here and the Uri.
‫So server requests Uri.
‫Now we can make it so that when we look at the Uri we don't include the query string which is what we
‫want.
‫So to do that we're just going to pass this in the server.
‫The server Superglobal here request Uri.
‫We're going to pass that into parse underscore URL.
‫It's URL, not Uri.
‫And then we just want to pass in a second argument of PHP underscore URL underscore path.
‫Okay, so if I save that now and even if I have ID equals two, it's still it's now going to load the
‫view because it's not including that ID equals two in the main Uri.
‫In fact if I inspect.
‫And die.
‫You are I.
‫Reload.
‫We just get listing.
‫But if I go back to what I just had, which was.
‫Just the I'm just going to do this temporarily.
‫If I go back to just having that and I reload, then its listing ID too, and that doesn't match a root.
‫So we want to keep it like this.
‫Okay.
‫And then just get rid of that inspect.
‫All right.
‫And we'll still be able to access this this ID, it's just not in the main route.
‫All right.
‫Now we want to use the database.
‫So let's go into our show controller where we're loading the view.
‫And I'm going to copy from the the index.
‫Where was it the home controller I'm just going to grab these two lines because we are using the database.
‫And then let's get the ID from the the get Superglobal.
‫So we'll say ID equals and let's say underscore get.
‫We want to get ID.
‫Let's use the null coalescing operator.
‫And let's make sure we're getting that.
‫Up here.
‫You can see we're getting two.
‫Good.
‫So next thing we want to do.
‫Is, is get the data from the database where that listing equals that ID.
‫Now this is I'm just going to give you an example of what you don't want to do.
‫So listing equals and let's say db query and then pass in select all from listings where.
‫Close that up where id is equal to.
‫And then we concatenate.
‫Concatenate ID which is our get ID and then let's say fetch.
‫And then for now, I'll just inspect.
‫And I'm using fetch because it's a single listing.
‫So let's reload that and we get the data right.
‫However, there's an issue here and that is that this this is coming from user input.
‫Right.
‫So if I put drop table or whatever in here I could I could really do some damage.
‫So this is why we need to use prepared statements.
‫And we've already gone over this.
‫But this is like a real life example of something you may see that is just not something you want to
‫do.
‫So we need to modify query to be able to handle params okay.
‫To be able to handle prepared statements with params.
‫So let's go to our database class.
‫Go to our query down here.
‫Query method.
‫And we're going to modify it to also take in params.
‫And we'll set that to just an empty array by default.
‫And then what we want to do before we actually execute, we want to bind the named parameters.
‫So let's say bind named params.
‫And we can do that by looping through let's say for each.
‫And we're going to loop through the params that are passed in.
‫So params params as.
‫Pram and we can get the.
‫We'll do this pram.
‫Value.
‫And then we want to take.
‫Um, our, our statement.
‫And there's a method called bind value.
‫Okay.
‫And we want to basically bind the colon, whatever the field is, like colon ID to just ID whatever's
‫passed in.
‫So we're going to pass in colon.
‫And then we're going to just add on whatever the parameter is.
‫Okay.
‫So we're just concatenating that.
‫And then we want to pass in the value.
‫All right.
‫So just doing that should allow us to pass in the, the params.
‫And it allow us to have real prepared statements that don't just put the user input directly into the
‫query.
‫So let's go back to the controller.
‫The show controller.
‫And now what we'll do is before the actual query.
‫We'll add params or we'll create a params array.
‫And we want to add our named parameters.
‫So we're going to say ID.
‫And that's going to be whatever the ID from here is.
‫But we're not going to put it directly in here.
‫What we're going to do is set ID equal to the placeholder of ID okay.
‫And then we just need to pass in params into the query.
‫Because remember we modified the query method to take in not only the query but also the params array.
‫All right.
‫What is this complaining about?
‫Get rid of that.
‫Oh, forgot my ending quote here.
‫Okay, so let's see if that works.
‫Actually I do want that inspect because I want to see if it works.
‫So we want to inspect listing.
‫Let's reload and we get the same thing.
‫But this is much, much safer and prevents SQL injections.
‫Okay, so now in the next video again we we get the data but we want to display it down here in the
‫view.