How to order a mysql query after using $_GET[]

Question

I'm using $_GET[] to get a unique id number from the url and then displaying every row that matches that unique id. his displays all the rows but now i'm stuck on how to corectly ordering it by another column name, as it wont allow me to use ORDER BY once I have used the $_GET[]. My query code is as follows

$query = 'SELECT * FROM magazine WHERE issue_number = ' . $_GET['unique_issue_id'];

I now want to order it by the issue_number column.

Thanks in advance

**Danger**: You are **vulnerable to [SQL injection attacks](http://bobby-tables.com/)** that you need to [defend](http://stackoverflow.com/questions/60174/best-way-to-prevent-sql-injection-in-php) yourself from. — Quentin, Oct 03 '17 at 15:43

rbaskam · Answer 1 · 2017-10-03T15:44:43.340

0

$query = 'SELECT * FROM magazine WHERE issue_number = ' . $_GET['unique_issue_id'] . ' ORDER BY issue_number';

Just remember to escape your GET Parameter before using it but this should work. Not sure what SQL you are using but here are a few ideas to consider.

Prepared Statements

MySql Escape

Mysqli Escape

edited Oct 03 '17 at 15:44

answered Oct 03 '17 at 15:41

rbaskam

749
7
22

1

**Danger**: You are **vulnerable to [SQL injection attacks](http://bobby-tables.com/)** that you need to [defend](http://stackoverflow.com/questions/60174/best-way-to-prevent-sql-injection-in-php) yourself from. – Quentin Oct 03 '17 at 15:42
Thank you very much, I will now be able to sleep easy tonight. Again Thank you... – Steven Lafferty Oct 03 '17 at 15:54

score 0 · Answer 2 · answered Oct 03 '17 at 15:52

Use the mysqli_prepare function to keep yourself safe from potential SQL Injection.

   //prepare the query
    $stmt = $mysqli->prepare("SELECT * FROM magazine WHERE issue_number=? order by issue_number"));
    $stmt->bind_param("s", $_GET['unique_issue_id'])

    //Execute the query
    $stmt->execute();

    //Loop through the results
    $result = $stmt->get_result();
    while ($myrow = $result->fetch_assoc()) {
    //Do stuff here
    }

Not doing so leaves your application vulnerable. Good luck!

How to order a mysql query after using $_GET[]

2 Answers2