Re: Variable Appended To The End of a URL Is Not Working in SQL Query

On Mon, 1 Apr 2002, Dr. Shim wrote: > I have a variable which is appeneded to the end of a URL, like > > > http://www.your_web_site.com/your_page/?your_variable=your_value > > This would return "your_value"; > > echo $your_variable; > > But this wouldn't work, and returns an error > > $sql = "SELECT * FROM fldField WHERE IDField = " . $id; Consider yourself lucky. Taking a variable supplied by a user and dumping it into a SQL query like that is basically the same as printing your database password on your front page. If it's a number, take intval() of it. If it's a string, addslashes() it or make sure that magic_quotes_gpc is on. And take your user-posted variables from $_REQUEST rather than from the variables that get created automatically (which you should turn off unless you REALLY know what you're doing because it's a dangerous feature). miguel