mysql_query where statement

Question

I am retrieving values from the url with the GET method and then using a if statement to determine of they are there then query them against the database to only show those items that match them, i get an unknown error with your request. here is my code

$province = $_GET['province'];
$city = $_GET['city'];

if(isset($province) && isset($city) ) {         
  $results3 = mysql_query("SELECT * 
                            FROM generalinfo 
                           WHERE province = $province 
                             AND city = $city  ") 
                       or die( "An unknown error occurred with your request");          
} else {             
  $results3 = mysql_query("SELECT * FROM generalinfo");  
} /*if statement ends*/

Mark Byers · Accepted Answer · 2010-05-16 22:02:12Z

6

You need single-quotes round your strings in SQL:

"SELECT * FROM generalinfo WHERE province='$province' AND city='$city'"

Note that constructing the query in this way could leave you at risk of an SQL injection vulnerabillity. Consider using mysql_real_escape_string instead.

"SELECT * FROM generalinfo WHERE province='" .
mysql_real_escape_string($province) . "' AND city='" .
mysql_real_escape_string($city) . "'"

answered May 16, 2010 at 22:02

Mark Byers

844k202 gold badges1.6k silver badges1.5k bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Felix Kling Over a year ago

+1 because the only correct way to deal with user input is to escape it.

bobince Over a year ago

+1 answer without a security hole in it. Consider also parameterised queries (mysqli/PDO).

Cool Guy Yo Over a year ago

Thanks for the quick response and this worked perfectly and I included the escapes option.

Collectives™ on Stack Overflow

mysql_query where statement

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related