php-Ordering an SQL Select statement using value from a drop down list

Question

I am trying to Order an SQL select query depending on what the user selects from a drop down list. Here is the code of the list

<select name="order">
  <option value="Patients_name">Name</option>
  <option value="Patients_age">Age</option>
  <option value="Patients_address">Address</option>
</select>

$ord=$_POST['order'];#taking the value from the list
$query="Select * from Patients ORDER BY '$ord'";
$result= mysql_query($query);

If i replace

$query="Select * from Patients ORDER BY '$ord'";

by $query="Select * from Patients ORDER BY Patients_age";

Patients_name,Patients_address
It perfectly works though printing $ord would give me the correct value. Any idea why it is not taking the value of $ord

Jessica · Accepted Answer · 2014-01-01 16:43:43Z

1

ORDER BY expects a column name. By putting it in quotes, you're making it a string. Remove the single quotes around $ord.

By the way, what you're doing is incredibly dangerous and open to SQL injection. You should verify the column submitted is in fact a column and allowed.

answered Jan 1, 2014 at 16:43

Jessica

6,99630 silver badges39 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Roudy Tarabay Over a year ago

Thank you,i've searched all over and couldn't find anything. And i don't have to worry about security for now.

Zword · Accepted Answer · 2014-01-01 16:47:11Z

0

Dont put $org within ''.

$query = "Select * from Patients ORDER BY $ord";

answered Jan 1, 2014 at 16:47

Zword

6,8013 gold badges30 silver badges53 bronze badges

Collectives™ on Stack Overflow

php-Ordering an SQL Select statement using value from a drop down list

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related