Dynamic query using PHP, MYSQL

Question

I'm trying to make a dynamic link which alters the database query depending on the items ID.

So if you click on a link WHERE "ID=X" it takes you to the next page which displays more information about that item. Here is the code for the link on my index page:

<a href="details.php?ID= <?php print $row['ID']?> "> Click here </a>

Which works fine. The problem seems to be in my WHERE statement, for some reason

<?php $myQuery = "SELECT * FROM test"; 
      $myQuery .= "WHERE ID=" . $_GET['ID']; 

$result = $con->query($myQuery);
`if (!$result) die('Query error: ' . mysqli_error($con)); ?>

And here I display the elements of that particular database item...

<?php

while($row = mysqli_fetch_array($result))
{ 
?> 
        <?php print $row['image'] ?>     
        <?php print $row ['ID']?>
        <?php print $row['description'] ?>

<?php
}
?>

For example when I click on the item with ID=1 it throws an error message that reads "Query error: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '= 1' at line 1"

I'm really new to all this and this is my first time posting on this site so it'd be really great if someone could help me out.. Thanks

Couple of notes. First, you don't seem to have a space between your table name and the WHERE. Second, please use parametrised queries / prepared statements instead of concat'ing your values into the SQL queries opening you up for SQL injection. — Jonnix
– Jonnix, Commented Nov 30, 2015 at 15:03
Thank you for pointing that out. Not really familiar with prepared statements but I will definitely be looking in to it before the site goes live — 92smallwizards
– 92smallwizards, Commented Nov 30, 2015 at 15:30

Benjamin W. · Accepted Answer · 2015-11-30 15:52:04Z

1

Your query will now be SELECT * FROM testWHERE ID=..

There needs to be a space between your tablename and the WHERE statement.

edited Nov 30, 2015 at 15:52

Benjamin W.

54k19 gold badges135 silver badges136 bronze badges

answered Nov 30, 2015 at 15:02

Benjamin Heek

562 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Strawberry · Accepted Answer · 2015-11-30 15:05:37Z

0

I think it's clearer, and less error-prone if you write your code like this:

<?php $myQuery = "
      SELECT *  
        FROM test
       WHERE ID= $_GET['ID'];
"; 
...

although, in production you would of course use prepared statements

answered Nov 30, 2015 at 15:05

Strawberry

34k14 gold badges43 silver badges57 bronze badges

2 Comments

92smallwizards Over a year ago

Not come across prepared statements until just now. Definitely something I'm going to have to look in to. From what I've just read its where you define and store part of a query preemptively and then add the remaining information later before executing?

Strawberry Over a year ago

Yes. It's more secure. But it can make it harder to see where errors are occurring in development code.

I wrestled a bear once. · Accepted Answer · 2015-11-30 15:15:58Z

0

Adding that space in your SQL will fix your query as is, but as others have said, your code is not secure and you should use prepared statements instead. When you do switch to prepared statements your query will break again because of all the extra space you've added to the link. To fix it correctly...

1) Remove all the unnecessary white-space in the link.

<a href="details.php?ID=<?php print $row['ID']?>"> Click here </a>

2) Use prepared statements: see here.

answered Nov 30, 2015 at 15:15

I wrestled a bear once.

23.5k20 gold badges74 silver badges122 bronze badges

Collectives™ on Stack Overflow

Dynamic query using PHP, MYSQL

3 Answers 3

Comments

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related