Re: Friday morning brain farts....

From:	Paul Novitski	Date:	Fri, 10 Aug 2007 15:01:11 +0000
Subject:	Re: Friday morning brain farts....
References:	1	Groups:	php.general
Request:	Send a blank email to php-general+get-260580@lists.php.net to get a copy of this message

At 8/10/2007 07:43 AM, Jason Pruim wrote:

I want to be able to sort that info so my sql query looks like: "Select * from current order by '$order';" and $order is populated by a GET when they click on a link: "<A href=index.php?order='Last'>Sort by last name</A>" Now... the whole PHP page is being included in a .shtml page to actually display it and make it look purrdee :) ...

$order = $_GET['order']; <------Line 6

Your HTML should read:

        <a href="index.php?order=Last">Sort by last name</a>

Note double-quotes around the href expression and no quotes around the querystring parameter value. Also, you'll want to check the incoming values to prevent SQL injection (q.v.). If you insert unevaluated input into an SQL query you're leaving yourself vulnerable to everything from data exposure to data manipulation from outside sources. Regards, Paul __________________________ Paul Novitski Juniper Webcraft Ltd. http://juniperwebcraft.com