Trouble with PHP/MySQL

Question

I am trying to set up a database of images that can be arranged into categorys (Lining, Fencing & Decking, Brickwork) although I'm having some trouble and can't seem to get unstuck, if anyone can help that would be great, my table consists of 3 columns; id, Img, category

EDIT: Forgot to mention I am trying to achieve this using a drop-down menu, on page load it should show all results, then can be filtered into categorys.. Weirdly it shows all images if the 'category' is set to '1', but if u set them to 'lining' or 'fencing & decking' it doesnt work. Not sure what's going wrong?

    <?php

define('DB_NAME', 'wlarter_portfolio');
define('DB_USER', 'wlarter_user');
define('DB_PASSWORD', 'pw');
define('DB_HOST', 'localhost');

$link = mysql_connect(DB_HOST, DB_USER, DB_PASSWORD);

if (!$link) {
    die('Could not connect: ' . mysql_error());
}

$db_selected = mysql_select_db(DB_NAME, $link);

if (!$db_selected) {
    die('Can\'t use ' . DB_NAME . ': ' . mysql_error());
}

$qry = "SELECT * FROM image ";
if(isset($_GET['category']) && is_numeric($_GET['category'])){
   $qry .=  "where category = ".$_GET['category'];
}
$results= mysql_query($qry) or  die(mysql_error());

?>


<?php
while ($row = mysql_fetch_assoc($results)) { ?>

<div class="box-portfolio"> <?php echo $row['Img']; ?> </div>

<?php 
}; 
?>

<?php
   $category = isset($_GET['category']) && is_numeric($_GET['category']) ? $_GET['category'] : 1; // where 1 is a default category to show!
?>
<select onchange="if(this.value != '') document.location = '/portfolio.php?category=<?php echo $category; ?>&order_by=' + this.value">
  <option value="">Choose an option</option>
  <option value="Fencing & Decking"<?php if(isset($_GET['order_by']) && $_GET['order_by'] == 'Fencing & Decking') echo ' selected="selected"'; ?>>Fencing & Decking</option>
  <option value="Lining"<?php if(isset($_GET['order_by']) && $_GET['order_by'] == 'Lining') echo ' selected="selected"'; ?>>Lining</option>
</select>

Welcome to Stack Overflow! Your code is vulnerable to SQL injection. See [How can I prevent SQL injection in PHP?](http://stackoverflow.com/q/60174) — Madara's Ghost, Apr 13 '14 at 11:47
You might want to edit your question to elaborate on where you're stuck. — faintsignal, Apr 13 '14 at 11:47
Usually when you have these situations where you can fathom why the code would not work its usually something really simple. Please confirm that the code does enter the if statement. Maybe $_GET['category'] isn't set? — Ronnie Jespersen, Apr 13 '14 at 12:04

score 0 · Answer 1 · answered Apr 13 '14 at 12:08

That's simple. You check if category GET parameter is numeric with is_numeric($_GET['category']), so it works with category set to a number (1), but doesn't work when you set it to a string ("lining", "fencing" etc.).

Try print the query with var_dump($qry) just before executing the query with mysql_query. You'll see how the query looks.

Trouble with PHP/MySQL

1 Answers1