PHP SELECT query With condition

Question

$query = mysql_query("SELECT M.msg_id, M.uid_fk, M.message, M.created, U.full_name, U.profile_pic, U.username, U.uid FROM t_haps_wall M, t_users U, t_join_user F WHERE
        M.uid_fk=U.uid AND F.uid=U.uid AND M.uid_fk = F.uid AND F.status='joining' order by M.msg_id desc ") or die(mysql_error());

That's my SELECT code to show some message and now I want to add 1 condition :

AND M.uid_fk='$uid'

So where I can put that in my complete code. I already tried but no effects. Or something missing / wrong code?
Please help. Thank you

score 1 · Answer 1 · edited May 23 '17 at 12:04

1

You should put it in the WHERE clause, and use the ANSI SQL-92 instead like so:

SELECT 
  M.msg_id, 
  M.uid_fk, 
  M.message, 
  M.created,
  U.full_name, 
  U.profile_pic, 
  U.username, 
  U.uid 
FROM t_haps_wall       M
INNER JOIN t_users     U ON  M.uid_fk = U.uid
INNER JOIN t_join_user F ON  F.uid    = U.uid
WHERE F.status = 'joining' 
  AND M.uid_fk ='$uid' -- your condition here 
order by M.msg_id desc

Note that: Your code this way is vulnerable to SQL injection , use PDO or prepared statements instead. See this for more details:

Best way to prevent SQL injection in PHP?

edited May 23 '17 at 12:04

Community

1
1

answered Nov 21 '12 at 08:54

Mahmoud Gamal

78,257
17
139
164

You might want to write something about SQL injections – Markus Hedlund Nov 21 '12 at 08:58
@Nagini - How it has no effect? any errors? doesn't return any data? Try to remove the condition `AND M.uid_fk ='$uid'` and check your data, may be doesn't contain that Id. – Mahmoud Gamal Nov 21 '12 at 09:04
@Nagini Also, try to run and debug the query in [an SQL client](http://code.google.com/p/sqlyog/downloads/list) before using it in your application code – Markus Hedlund Nov 21 '12 at 09:06

score 0 · Answer 2 · answered Nov 21 '12 at 08:53

Like this?..

$query = mysql_query("SELECT M.msg_id, M.uid_fk, M.message, M.created, U.full_name, U.profile_pic, U.username, U.uid FROM t_haps_wall M, t_users U, t_join_user F WHERE
    M.uid_fk=U.uid AND F.uid=U.uid AND M.uid_fk = F.uid AND F.status='joining' AND M.uid_fk=".$uid." order by M.msg_id desc ") or die(mysql_error());

I was assuming you wanted to place the M.uid_fk=".$uid." in your WHERE condition. The (.) operator isn't really necessary because you have double quotes around your query, but I like to use it anyway.

score 0 · Answer 3 · answered Nov 21 '12 at 08:54

It would have been better if you have searched first before raising this question ::

Anyways :: check the placement of NEW_COLUMN

$query = mysql_query("SELECT M.msg_id, M.uid_fk, M.message, M.created, U.full_name, U.profile_pic, U.username, U.uid, NEW_COLUMN FROM t_haps_wall M, t_users U, t_join_user F WHERE
        M.uid_fk=U.uid AND F.uid=U.uid AND M.uid_fk = F.uid AND F.status='joining' order by M.msg_id desc ") or die(mysql_error());

Abhilash · Answer 4 · 2012-11-21T09:01:54.600

You can add it wherever* you want after the WHERE clause. Try with this updated query

$sql =
"
SELECT 
   M.msg_id, 
   M.uid_fk, 
   M.message, 
   M.created, 
   U.full_name, 
   U.profile_pic, 
   U.username, 
   U.uid 
FROM 
   t_haps_wall M, 
   t_users U, 
   t_join_user F 
WHERE 
   M.uid_fk=U.uid 
   AND F.uid=U.uid 
   AND M.uid_fk = F.uid 
   AND F.status='joining' 
   AND M.uid_fk='".$uid."'
ORDER BY 
   M.msg_id DESC
";

$query = mysql_query($sql);

*I have added it at the end. Although, I say wherever and it works; it is not strictly the most optimal way. Placement of conditions can often influence how efficiently the queries run

PHP SELECT query With condition

4 Answers4