case 'editprod2' :
			//validate
			if (!isset($_GET['id']) || !is_numeric($_GET

['id'])) //added !isset and used !is_numeric
			{
			  	echo "<h1>Invalid product selected!

</h1>";
			  	break;
			}
			$_GET['id'] = (int)$_GET['id']; 
			$str = "SELECT * FROM products WHERE 

`prod_id`= ".($_GET['id'])." LIMIT 1"; 
			$qry = mysql_query($str) or die("Invalid 

prod_id used! [mysql error: ".mysql_error()."]");
			if ($row = mysql_fetch_assoc($qry)){		

	
			$string = "SELECT * FROM `categories` ORDER 

BY `cat_id` = ".$_GET['id']."";
			$query = mysql_query($string) or die("Invalid 

prod_id used! [mysql error: ".mysql_error()."]");
			echo "<b>Edit Product:</b><hr>";
			?>
            <form action="?do=submitprod" method="POST" 

enctype="multipart/form-data"/>
			<table>
  			<tr>
    		<td align="left" valign="middle">Product Name</td>
    		<td align="left" valign="middle">
      		<input type="text" name="name" size="40" value="<?php 

echo $row['prod_name']; ?>" />
      		</td>
            </tr>
            <tr>
            <td align="left" valign="middle">Category</td>
            <td align="left" valign="middle">
            <select name="category" value="<?php echo $row

['prod_cat_id']; ?>">
			<?php 
			while ($myrow = mysql_fetch_assoc($query)){
			echo '<option value="'.$myrow

['cat_id'].'">'.$myrow['cat_name'].'</option>';
			}
			?>
            </select>
  			</tr>
            <tr>
            <td align="left" valign="top">Description</td>
            <td align="left" valign="middle"><textarea name="desc" 

cols="34" rows="8"><?php echo $row['prod_desc'] ?></textarea>
            </td>
            </tr><tr>
            <td colspan="2" align ="left">
            Image Upload:
			Select a file to upload: <br />
			<input type="file" name="file" size="50" />
			<br />
            </td>
            </tr>
  			<tr>
    		<td colspan="2" align="center"><input type="submit" 

name="submit" value="Add Product" /></td>
 			</tr>
			</table>
			</form>
        	<?php           
			}
			break;