I'm having troubles selecting data from a MySQL databse

Question

I'm attempting to make a column be included only if the ID of the column is in the web address. But it's not returning the data. Any suggestions?

This is what my code looks like

$sql="SELECT * FROM orders WHERE `orders`.`id`= '$form_id'";
$order_data=mysql_query($sql);
$form_id=$_GET['id'];

If anyone has any suggestions, please let me know.

You're trying to use the `$form_id` value before it even exists. Things have to exist *first* before you can use them. Also, side note, this is wide open to SQL injection. — David, Jul 01 '16 at 21:02

score 0 · Answer 1 · answered Jul 01 '16 at 21:06

0

You may use this

$form_id=$_GET['id'];
$sql="SELECT * FROM orders WHERE `orders`.`id`= '$form_id'";
$order_data=mysql_query($sql);

Hopefully this will solve your problem

answered Jul 01 '16 at 21:06

Jahid Mahmud

1

Well, it'll solve *a* problem. But it enables the SQL injection problem. – David Jul 01 '16 at 21:08
Maybe you should mention [exploits of a mom](https://xkcd.com/327/). – alvits Jul 01 '16 at 22:04

1 Answers1