php - $_GET for MySQL query causing Unknown column error -
i have series of links pass information new page run mysql query. 1 of links source code:
<a class="bloglink" href="parknews.php?tpf_news.park_id=5">
and code generates links:
<a class="bloglink" href="parknews.php?tpf_news.park_id=<?php echo $row2['park_id'];?>"> <?php echo $row2['name']; ?> </a>
the query uses info here:
$park_id = $_get['tpf_news.park_id']; $sql = 'select headline, story, date_format(date, "%d-%m-%y") date, name tpf_news inner join tpf_parks on tpf_news.park_id = tpf_parks.park_id tpf_news.park_id = $park_id order date desc' ;
this causes error display:
error fetching news: sqlstate[42s22]: column not found: 1054 unknown column '$park_id' in 'where clause'
i can't work out why not working. if in query replace where tpf_news.park_id = $park_id
where tpf_news.park_id = 6
(or other number), works fine.
any ideas?
when strings in quotes variables aren't interpolated. need use double quotes instead:
$sql = "select headline, story, date_format(date, '%d-%m-%y') date, name tpf_news inner join tpf_parks on tpf_news.park_id = tpf_parks.park_id tpf_news.park_id = $park_id order date desc" ;
or use concatenation:
$sql = 'select headline, story, date_format(date, "%d-%m-%y") date, name tpf_news inner join tpf_parks on tpf_news.park_id = tpf_parks.park_id tpf_news.park_id =' . $park_id .' order date desc' ;
fyi, wide open sql injections
Comments
Post a Comment