How do you implement variables returned from other pages in repeating regions?

[johnmcg0000]

Hello I am only new to this site (my first post) and I am also only new to PHP. I have a site designed call http://www.mediareviewzone.com and I am trying to modify it using PHP. What I am trying to do is when a option is selected in the navigation menu then it will get a variable which will be referenced with a SQL database and then repeated regions will be populated with the table data. For example if you select horror genre in the movies menu, horror will be saved into the url and then the repeated regions will only show the horror movies. The code I have so far is shown below. The repeat region works fine, the only problem I am having is the first if else statement. gen is the variable that would contain horror for the example described above. Thanks for your help and time, as I stated I am only a new to PHP and this is probably an easy question.

 

<?php 
	if (isset($gen)){
	        $subject_set = mysql_query("Select * FROM movies WHERE genre ={$_GET['gen']}", $connection);}		
	else{
                      $subject_set = mysql_query("Select * FROM movies", $connection);			
	}
	if (!$subject_set){
	       die("Database connection failed: " . mysql_error());
	}
                             while ($subject = mysql_fetch_array($subject_set)){?>
                                   <div class="par_element">          		  
                                   <div class="par_element2">
                                   <h2> <a href=" <?=$subject['link']?>"><?=$subject['title']?> Review</a></h2>
                                   <?= $subject['description']?> 
                                   <a href=" <?=$subject['link']?>"> read more on <?= $subject['title']?>.</a></div>
                                   <a href="<?=$subject['link']?>"> <img src=" <?=$subject['picture']?>" 
                                    alt="<?=$subject['title']?>" name="<?= $subject['title']?>" 
                     width="65" height="100" border="0" id="<?= $subject['title']?>" /></a>			
             </div>
        <?php } ?>

[jotorres1]

Are you declaring $gen with the following statement:

 

<?php
   $gen = $_GET['gen'];
?>

 

Also, you need to be careful with that script.  It is at high risk for mysql injection.  Take a look at this tutorial from tizag to understand a bit of injection.

http://www.tizag.com/mysqlTutorial/mysql-php-sql-injection.php

[johnmcg0000]

$subject_set = mysql_query("Select * FROM movies WHERE genre ={$_GET['gen']}", $connection);}

 

This is the area I am having problems with. genre ={$_GET['gen']}" Genre is a column in my table and gen is a variable added to the url. For example if you select shooter games in the previous page then gen would contain 'shooter' and I am trying to then search the genre column and only return games that have shooter genre.

 

I understand that the way I am coding is not very safe but I will look into protecting it when I have this part working. I do not have any user accounts or passwords at the moment. Thanks again for your help.