having problem with $_GET

[rastaman46]

Hello again

 

here is my code but its dont work correct

 

$super = $_GET['video_id'];
        $filmai = $TSUE['TSUE_Database']->query("SELECT rasta_cinema.video_id, rasta_cinema.name, rasta_cinema.description, rasta_cinema.video_name, rasta_cinema.thumb_image FROM rasta_cinema WHERE video_id = $super LIMIT 1");
        

 

 

error im get is

 

Database Error!
Please try again later or contact an Administrator.
(1064) You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'LIMIT 1' at line 1 SELECT rasta_cinema.video_id, rasta_cinema.name, rasta_cinema.description, rasta_cinema.video_name, rasta_cinema.thumb_image FROM rasta_cinema WHERE video_id = LIMIT 1

 

 

Thanks

[scootstah]

Put quotes around the variable.

 

WHERE video_id = '$super' LIMIT 1

 

Also, don't stick user input into your database like that or you will be vulnerable to SQL injection. I don't know what you're using to connect to the database so I can't offer any specifics.

[AyKay47]

Scootstah beat me to it here, but he's correct on one account.

Since $super is passed from the query string, it is type string.

So either cast it to an int or use intval() to sanitize the data.

and be consistent with field qualifiers.

 

$super = intval($_GET['video_id']);
        $filmai = $TSUE['TSUE_Database']->query("SELECT rasta_cinema.video_id, rasta_cinema.name, rasta_cinema.description, rasta_cinema.video_name, rasta_cinema.thumb_image FROM rasta_cinema WHERE rasta_cinema.video_id = $super LIMIT 1");

[scootstah]

So either cast it to an int or use intval() to sanitize the data.

 

As long as the video_id field is an integer.

 

 

[AyKay47]

So either cast it to an int or use intval() to sanitize the data.

 

As long as the video_id field is an integer.

 

right, it has "id" in the name so one can only assume it's an int.

[rastaman46]

Thanks you save my day...