Linux mysql sort to mysqli sort not working

[stpsoft]

This was a working sort before we upgraded our web server....

 $result = (isset($sort)) ? mysqli_query($db, "Select * from ". $company . " where member = $member_numbers[$i] order by location, $sort, name")
: mysqli_query($db, "Select * from " . $company . " where member = $member_numbers[$i] order by location, name");
 

Data is display, just not sorted....

Thanks

[Barand]

Have you checked what "$sort" contains when it isn't working?

[stpsoft]

Appears to be blank

After the table heading is selected, the script is re-executed as "detail_report.php?sort=rcvd_date"

How do I set the variable sort at the beginning of the script?

Thanks

 

 

[cyberRobot]

What does the code for setting $sort look like? Have you tried setting PHP to show all errors and warnings? Perhaps that will provide a clue.

[stpsoft]

Script works under php 5.....upgrading to php 7

$result = (isset($sort)) ? mysqli_query........(as shown above)

isset($sort) does not appear to set the "sort" variable

Edited June 25, 2019 by stpsoft
add additional info

[stpsoft]

Solved it.....used $_GET to get the "sort" variable.

Thanks

 

[Barand]

Just my 0.02 worth ...

1. It is always a bad idea to place values provided by the user ($_GET, $_POST, $_COOKIE) directly into your SQL. A better way is this, which avoids doing that and also checks that only valid column names can be used

$sort = $_GET['sort'] ?? '';
switch ($sort) {
    case 'recd_date':
            $orderby = 'location, recd_date, name';
            break;
    case 'sent_date':
            $orderby = 'location, sent_date, name';
            break;
    case 'birth_date':
            $orderby = 'location, birth_date, name';
            break;
    default:
            $orderby = 'location, name';
            break;
}

2. Use prepared statements to place values into your query

$result = $db->prepare("SELECT *
                       FROM $company
                       WHERE member = ?
                       ORDER BY $orderby
                       ");
$result->bind_param('i', $member_number[$i]);
$result->execute();

3. The use of that [$i] index - are you running the query in a loop for different member_numbers? Don't.

4. You have a variable table name ($company) which suggests you have several tables, each for a different company. Better to have a single table and add an indexed "company" column.