[SOLVED] Can I check a WHERE condition against a PHP variable?

[labiere]

Noob here. I haven't been able to find an example of this syntax, although it seems like it ought to be a common situation.

 

I am passing a parameter to my page in the URL via a query string

http://www.labiere.com?drink=beer

 

I parse the parameter using $_GET:

$drink = $_GET['drink'];

 

Now I want to make a query to my SQL table where my condition is to grab the row that has $drink as the index.

// Incorrect syntax

$query = "SELECT * FROM table WHERE beverage=$drink";

 

Is this a syntax error, or do I instead have to select each row and check its value against $drink in a looped if statement?

[SeanHarding]

$query = "SELECT * FROM table WHERE beverage='$drink'";

 

dont forget to ' ' your variable.

[Johntron]

Looks good, but you still have to pass the resulting $query to mysql_query(). Your code still has a serious security vulnerability too though. It'd be really easy for someone to see things they shouldn't with a simple SQL injection.

[labiere]

Your code still has a serious security vulnerability too though. It'd be really easy for someone to see things they shouldn't with a simple SQL injection.

 

Can you point me to a topic thread or URL on this subject? Fortunately there is nothing sensitive in my DB on this site, but I would like to learn the best methods from the start.

[SeanHarding]

Im guessing the best way to learn would be to try a book, but its always good to get a basic knowlege of how things work anyway.

 

Just keep playing for now.

 

I have found that to be the best way for me.

 

You only realy have to worry about injection attacks if you have sensative information in your database like names addresses nuklear launch codes ect. But for now if you dont mind people looking through your test databases (or loosing them) just keep playing.

[Johntron]

At the very least, use mysql_real_escape_string on any user input before inserting it into the database. http://us.php.net/manual/en/function.mysql-real-escape-string.php

 

hackthissite.org is a good place to learn about SQL injections and more. Hands on hacking tutorials, woohoo!