PHP JOIN LEFT WHERE wont work. what have i done wrong?

Question

 $sql= "SELECT name, content FROM {$dbpraefix}meta_global 
           UNION SELECT name, content FROM {$dbpraefix}meta_local 
           LEFT JOIN {$dbpraefix}pages ON {$dbpraefix}pages.id={$dbpraefix}meta_local.page 
           WHERE {$dbpraefix}pages.alias = $_GET['include']";

Hello Everyone. whats wrong with the last part of my code.

WHERE {$dbpraefix}pages.alias = $_GET['include']"

my page doesnt work. but if i throw the last part, it works well. this is a part of my "build your own CMS" projekt. thanks for your answers.

More importantly, this code is incredibly open for injection. I could put anything for the `include` variable and inject directly into the query. Very scary stuff. I'd suggest researching PDO or Mysqli — Tyler Roper, Sep 13 '16 at 13:43
I have a name filter. (Its stings array) does it still dangerous? Should i avoid get_include at all? — Syarif Mathis, Sep 13 '16 at 17:42

score 0 · Answer 1 · answered Sep 13 '16 at 13:42

0

Try this : add single quote

$sql= "SELECT name, content FROM {$dbpraefix}meta_global 
           UNION SELECT name, content FROM {$dbpraefix}meta_local 
           LEFT JOIN {$dbpraefix}pages ON {$dbpraefix}pages.id={$dbpraefix}meta_local.page 
           WHERE {$dbpraefix}pages.alias = '".$_GET['include']."'";

answered Sep 13 '16 at 13:42

Rijin

625
1
4
13

sure, if it's a string. But we don't know that yet ;-) – Funk Forty Niner Sep 13 '16 at 13:42
Yes its string thanks alot. But what if its a number (int, double etc) sorry newbie question :) – Syarif Mathis Sep 13 '16 at 17:41
@SyarifMathis In that case you can skip the quotes, no problem occurs if you use quotes – Rijin Sep 20 '16 at 15:45

PHP JOIN LEFT WHERE wont work. what have i done wrong?

1 Answers1