Code Forums - View Single Post

bdl · 03-07-2008, 08:32 PM

Is there an error returned from the query? Take a look at the string MySQL sees:

(as an example, let's say $_GET['zone'] is 'column1' and $_GET['name'] is 'Bob')

Code:

SELECT *
FROM livestock
WHEREcolumn1LIKE '%Bob%'

Doesn't look right, does it? You're not formatting the string properly; make sure you leave some space between the WHERE clause and the column name, e.g.

Code:

SELECT *
FROM livestock
WHERE column1 LIKE '%Bob%'

Now, that's an absolutely valid query, but is it what you want? Refer to the MySQL manual page for the LIKE operator and basic pattern matching. If you need to control a more specific pattern, look into regular expressions.

In addition, it's important to be aware that using unvalidated, unescaped GET (or POST) data straight in your query is a Very Bad Idea, especially if you're using 'dynamic column names'. I'd suggest storing a list of allowed columns in an array and only allowing those columns to be accessed.

03-07-2008, 08:32 PM	#2 (permalink)
bdl Senior Contributor Join Date: May 2002 Location: vta.ca.usa Posts: 555	Is there an error returned from the query? Take a look at the string MySQL sees: (as an example, let's say $_GET['zone'] is 'column1' and $_GET['name'] is 'Bob') Code: SELECT * FROM livestock WHEREcolumn1LIKE '%Bob%' Doesn't look right, does it? You're not formatting the string properly; make sure you leave some space between the WHERE clause and the column name, e.g. Code: SELECT * FROM livestock WHERE column1 LIKE '%Bob%' Now, that's an absolutely valid query, but is it what you want? Refer to the MySQL manual page for the LIKE operator and basic pattern matching. If you need to control a more specific pattern, look into regular expressions. In addition, it's important to be aware that using unvalidated, unescaped GET (or POST) data straight in your query is a Very Bad Idea, especially if you're using 'dynamic column names'. I'd suggest storing a list of allowed columns in an array and only allowing those columns to be accessed.