Data type for $_GET: does it matter?

[IgnatiusR]

I'm brand new to PHP and MySQL and as my first project I'm trying to build category navigation from a single table named testdata. Columns in the table are: recordid, category, subcategory, and detail.

I use one php script (cat1.php) to query the table and display a distinct list of top level categories as links. That works fine. The links are displayed with:

<a href=\"cat2.php?category={$row['category']}\">{$row['category']}</a>

Each link goes to cat2.php?category=CATEGORYNAME, and cat2.php is supposed to query the subcategory column using $_GET to determine the subcategories to display. This is my query in cat2.php:

$query = "SELECT DISTINCT(testdata.subcategory), testdata.category FROM testdata WHERE testdata.category = {$_GET['category']}";

This doesn't work. However, I've tried using recordid instead of category (as in cat2.php?recordid=RECORDID), which is a unique key field, and that does work. Obviously that returns every record, however, when I'm really just trying to return distinct subcategories.

My point is that the query works when $_GET is looking for a number, but it doesn't work when it's looking for a VARCHAR or TEXT value. Why would this be? Is something inherently wrong with my method? Take it easy now, I'm brand new to this 😉

I know this may not be the smartest method, but I'm using this as a basic model to help me learn. I've figured out how to accomplish the same functionality if I have separate tables for categories and detail items, but in the future I will receive data in a single table every day and I don't want to have to manipulate it.

Thank you,
IgnatiusR

[laserlight]

Yes, there is something inherently wrong with your method.

The thing is, you need to validate your incoming variables.
If you expect a numeric value, you should check that the incoming variable is numeric, perhaps by using [man]is_numeric/man, [man]ctype_digit/man, or a regular expression match.

In this case, you expect a string, so you should use single quotes to delimit the variable, e.g.

$query = "SELECT DISTINCT(testdata.subcategory), testdata.category FROM testdata WHERE testdata.category = '{$_GET['category']}'";

You could also use single quotes even if you expect a numeric value.

of course if magic_quotes_gpc is set to 0, then you should also use addslashes() to the incoming variable first, to help stop SQL injection.

[IgnatiusR]

Thanks for the help. Before I read your reply I found something that worked, but I'm not completely sure why:

$catid = $_GET['category'];
$query = "SELECT DISTINCT(testdata.subcategory), testdata.category FROM testdata WHERE testdata.category = '$catid'";

Your explanation, however, sheds some light on why this works. Maybe this brings it in as a string value, as you indicate it should be, in a slightly different way.

Thank you,
IgnatiusR

[Moonglobe]

the problem was the 's in thr {} part. inside a string, ust use [ and ] to delimit indices, not [' and '].

hth
moon🙂