I need a pagination algorithm

Question

Here I have a function that gets images from a data table. I need an algorithm that will give me the right pictures depending on what the $page variable is. I have two variables called $max and $min. They show to right pictures on the first page and then it gets messed up. Every page holds a different amount of data I would like to change the $amount variable but I don't know if it have to fixed for the algorithm to work.

function getPhotos() {
    $page = 1
    $columns = 4;

    if (isset($_GET['page'])) {
        $page = $_GET['page'];
    }
    $amount = 2;

    $min = $page * $amount - $amount;
    $max = $min + $amount;

    $query = "SELECT `name` FROM `pictures` ORDER BY `id` DESC LIMIT ".$min.", ".$max."";
    $query_run = mysql_query($query);
    if (mysql_num_rows($query_run) == 0) {
        echo '<h3 class="bad">There are no Photos</h3>';
    } else {
        $x = 1;
        echo '<table id="photoGallery" cellspacing="0" cellpadding="0">';
        while ($row = mysql_fetch_assoc($query_run)) {
            if ($x == 1) {
                echo '<tr>';
            }
            echo '<td><a href="../Pictures/'.$row['name'].'" target="_blank"><div onclick="click(this)" style="background: url(../Pictures/'.$row['name'].') 50% 50% no-repeat; background-size: 100%; width: 150px; height: 150px; margin: auto;"></div></a></td>';
            if ($x == $columns) {
                echo '</tr>';
                $x = 0;
            }
            $x++;
        }
        echo '</table>';    
    }
}

Why is every SQL-related question completely vulnerable to injection? Who'd you copy this code from? I need to write them a strongly-worded email. — Meredith, May 26 '14 at 23:51
Id like the $amount variable to be a multiple of 4 so I get even rows — user3131261, May 26 '14 at 23:56
@Dagon Yeah actually I just skipped right to the query, saw the concatenation, and assumed it was insecure. Still, it looks like he doesn't have much knowledge of how to prevent SQL injection, so he should do some research on it. — Meredith, May 26 '14 at 23:58
I know how to prevent sql injection I just thought since you said is wasn't secure there was something I didn't know about — user3131261, May 27 '14 at 00:00
its fine, you could check if $page ($_GET['page']) is an integer, but there's no security threat — , May 27 '14 at 00:01
Regarding injection, see [this](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php). — Meredith, May 27 '14 at 00:02
PDO if you can, but some of us (ME) will be using mysql for legacy apps for decades to come — , May 27 '14 at 00:05
If I do change to either one of those will they all work, for example mysqli_connect, and for PDO do I use PDO_*? — user3131261, May 27 '14 at 00:06

I need a pagination algorithm

0 Answers0