Special Way to Use $_GET['var'] in SQL?

[Levr0x0rz]

Hello,

 

I've been posting a lot, ensure I'm looking things up and reading around before I post something.

 

I'm trying to execute a SQL statement, using $_GET['var'].  It's just not working at all, and I was wondering if someone could shine some light on this for me.

 

With this below code, I'm aiming to have a structure such as news.php?id=1 (where 1 would be the news_id of the row).  Manually going to the news.php?id=1 pulls proper content, but when there is no id specified, or it does not exist, nothing is displayed.

<?php
			$id = isset($_GET['id'])?$_GET['id']:null;
			switch ($id)
  				{
    				case $id:
    					$sql = "SELECT * FROM news WHERE news_id = '$id'";
    					if(!$result = $db->query($sql))
    					{
    						die('There was a problem running the query. [' . $db->error . ']');
    					}
    					while($row = $result->fetch_assoc())
    					{ ?>

    					<table class="content">
							<tr>
								<td class="content_header"><a href="news.php?id=<?php echo $row['news_id']; ?>"><?php echo $row['title']; ?></td>
							</tr>
							<tr>
								<td class="content_highlight">Posted by <a href="roster.php?id=<?php echo $row['roster_id']; ?>">-VoW- <?php echo $row['author']; ?></a> on <?php echo $row['date']; ?></td>
							</tr>
							<tr>
								<td class="content_data"><?php echo $row['content']; ?></td>
							</tr>
						</table><br />

      					<?php }
    				break;
    				default:
    					$sql = "SELECT * FROM news";
    					if(!$result = $db->query($sql))
    					{
    						die('There was a problem running the query. [' . $db->error . ']');
    					}
    					while($row = $result->fetch_assoc())
    					{ ?>

    					<table class="content">
							<tr>
								<td class="content_header"><a href="news.php?id=<?php echo $row['news_id']; ?>"><?php echo $row['title']; ?></td>
							</tr>
							<tr>
								<td class="content_highlight">Posted by <a href="roster.php?id=<?php echo $row['roster_id']; ?>">-VoW- <?php echo $row['author']; ?></a> on <?php echo $row['date']; ?></td>
							</tr>
							<tr>
								<td class="content_data"><?php echo $row['content']; ?></td>
							</tr>
						</table><br />

      					<?php }
  				}
			?>

As you can see from above, for the id queries, I'm pulling a table to display only that particular query, where if there is no id being queried, or it doesn't exist (default case), I'm displaying all news.

 

Jon
Aspiring Web Developer
@JonEdney1

[trq]

Your switch statement makes little sense. The first case will always be true because your are comparing $id with $id.

 

Besides that, your really need to ensure users inputted data is sanitised. At the very least look at bound parameters. See http://php.net/manual/en/pdostatement.bindparam.php

[Levr0x0rz]

Thank you for your comments.  Should there be an alternative way to achieve what I am trying to do, rather than switch statements?  I considered using if-statements, and was told switches are a preferred method.

I'm working on a db driven site for an online gaming team, so such switches or if statements will be used everywhere, to allow different content to be displayed on the same page (eg. roster.php?id=10 and roster.php?status=active&recruit=no), for example.

 

Jon
Aspiring Web Developer
@JonEdney1

[mac_gyver]

another thing to look at is DRY (Don't Repeat Yourself.)

 

your code is picking between two variations of one query. the only thing your condition logic should be doing is forming the part of that one query that changes when you have and don't have the id. the rest of your code should only exist once.

 

if you form the WHERE news_id = '$id' part of the query in a php variable, something like $where (set it to an empty string when there is no id), your query would become - $sql = "SELECT * FROM news $where";