'Sort' rows in a table

[tomhoad]

Hi, I can't see where this script is failing. It doesn't appear to sort correctly (just randomly).

 

<table width="200" border="1">
<tr>
<td><b>Email <a href="view_members.php?sort=email">[sort]</a></b></td>
<td><b>Name <a href="view_members.php?sort=name">[sort]</a></b></td>
<td><b>Date of Birth <a href="view_members.php?sort=dob">[sort]</a></b></td>
<td><b>Favourite Artist <a href="view_members.php?sort=fav_artist">[sort]</a></b></td>
<td><b>Favourite Genre <a href="view_members.php?sort=fav_genre">[sort]</a></b></td>
</tr>
    
<?php
    
if(isset($_GET['sort']))
{
	$query = "SELECT id, name, email, fav_artist, fav_genre, FROM_UNIXTIME(dob, '%e/%c/%Y') as dob FROM users ORDER BY '{$_GET['sort']}'";

	$result  = mysql_query($query) or die('Error : ' . mysql_error()); 
	while ($row     = mysql_fetch_array($result, MYSQL_ASSOC)) { 

	$id   = $row['id']; 
	$name   = $row['name']; 
	$email   = $row['email']; 
	$dob   = $row['dob'];
	$fav_artist   = $row['fav_artist'];
	$fav_genre   = $row['fav_genre'];
	?>

	<tr>
	<td><?php echo $email;?></td>
	<td><?php echo $name;?></td>
	<td><?php echo $dob;?></td>
	<td><?php echo $fav_artist;?></td>
	<td><?php echo $fav_genre;?></td>
	</tr>

	<?php
	}
}
?>

 

Any help appreciated

 

[cags]

What is the contents of $_GET['sort'] ? Aside from the obvious security issues with your code, I'm assuming the $_GET['sort'] is supposed to represent a column name, that being the case it shouldn't be enclosed in single quotes.

[tomhoad]

Ok great, thanks a lot.

 

I assume by security issues you mean not sanitizing the Get data?

 

Also, the sort now works for all fields except the date of birth, and I'm pretty sure this is because this is stored as a timestamp - can you advise on how to successfully be able to sort that?

 

Thanks!

[.josh]

try removing the single quotes around $_GET['sort'] in your query:

 

'{$_GET['sort']}'

 

to

 

{$_GET['sort']}

 

also, to address cag's note about security, inside your condition, above your $query = ... you should at the very least do something like this:

$allowed = array('email','name','dob','fav_artist','fav_game');
$_GET['sort'] = (in_array($_GET['sort'],$allowed)) ? $_GET['sort'] : $allowed[0]; // change [0] to whatever element you want as default