select from where - question

[aprentis2]

I have a question about a query, I am using the query to select lines from a database that would match po_number is the table. The problem is when I enter a po_number it may or may not include the character " - ".

When I do not include the character just numbers & letters (123abs456) it returns the query with no problems, But when I use (123-abc-456) it gives me an error.

rows, [] , error: Unknown column 456 in 'where clause'

any help would be appreciated.


[code]
<?

$orderid=$_GET['id'];
$sql="select * from sc_order where po_number=$orderid";
mysql_select_db($dbname,$db);
$result=mysql_query($sql);
$dt=date('Y-m-d')." / ".date('h:i:s');

if(! $result || mysql_error() || mysql_num_rows($result) < 1)
{
echo sprintf('%s rows, [%s] , error: %s',
@mysql_num_rows($result),
$query,
mysql_error());
exit;
}
else
{
echo"No errors found";
}
?>

<table align="center" border="0" class="tablegreenl" width="70%">

<tr class="tablegreend">
<td><b>Date/Time</b></td>
<td align="right"><b>User Name</b></td>
<td align="right"><b>Database</b></td>
<td align="right"><b>Product Id</b></td>
<td align="right"><b>Quantity</b></td>

<?
if(mysql_num_rows($result)<1)
{
?>
<tr><td align="center" colspan="5">No Records</td></tr>
<?
}
?>
<tr><td align="center" colspan="5"><hr></td></tr>
<tr>
<?
while($rs=mysql_fetch_array($result))
{
?>

<td><?=$dt?></td>

<td align="center"><?=getname('sc_user','userid',$rs['userid'],'username')?></td>
<td align="center"><?=$dbname?></td>
<td align="center"><?=getname('sc_products','prod_id',$rs['prod_id'],'prod_name')?></td>
<td align="center"><?=$rs['quantity']?></td>

<tr>
<?
}
?>

[/code]

[.josh]

try putting some quotes around it:

$sql="select * from sc_order where po_number=[!--coloro:red--][span style=\"color:red\"][!--/coloro--][b]'[!--colorc--][/span][!--/colorc--][/b]$orderid[!--coloro:red--][span style=\"color:red\"][!--/coloro--][b]'[!--colorc--][/span][!--/colorc--][/b]";

[aprentis2]

I tried quotes, I then get the error

rows, [] , error: Unknown column '123-abc-456' in 'where clause'

works fine if I remove the "-" 's from the po_number

[.josh]

umm... so are you doing something to $orderid before you use it in the query, like stripslahes or striptags or something?

edit : nvm you aren't.. hmm...

[aprentis2]

The orderid is actually the po_number tranferred via url link.

I left the top few lines of the code out in the above because I didnt think they had anything to do with the actual problem.

I can echo $po_number and echo $orderid and they are the same.

I'm sure it has something to do with the dashes, Not sure this is really the first php project I have really worked on. So far everything has been great until this problem.

[aprentis2]

I tried the quotes again, Seems to be working now.

I'm thinking I may have mistyped the quotes before maybe using ` or " not sure.

Thank you very much for the help