sorting problems

jd57

Hi Everyone,

I need your help to figure out what I’m doing wrong, This code is to sort table by the selection made from a drop menu, and the only parts that sorts in alphabetical order and numericaly is "origin" and id . Can you please tell me what's wrong with this code

<?php

session_start();

include("config.php");


//make connection to dbase
$connection = @mysql_connect($server, $dbusername, $dbpassword)
	or die(mysql_error());

$db = @mysql_select_db($db_name,$connection)
	or die(mysql_error());

$sql="SELECT * FROM ihsreg ORDER BY '$_POST[D1]'";
$result = @mysql_query($sql, $connection) or die(mysql_error());

while ($sql = mysql_fetch_object($result)) 
{
    $id = $sql -> id;
	$bn = $sql -> Bloom_Name;
	$pn	=	$sql -> Pod_Name;
	$pln	=	$sql -> Pollen_Name;
	$hybrid	=	$sql -> Hybridiser;
	$origin	= 	$sql -> Origin;
	$gro	=	$sql -> Grower;	
?>
<body bgcolor="#FFFFFF">
<table width="100%" cellspacing="2" cellpadding="0" bgcolor="#FFFFFF">
  <tr bgcolor="#CCCCCC"> 
    <td width="7%" height="2"> 
      <div align="center"><b><font color="#000000" face="Trebuchet MS" size="1"><?php echo $id; ?></font></b></div>
    </td>
    <td width="17%" height="2"> 
      <div align="center"><b><font color="#000000" face="Trebuchet MS" size="1"><?php echo $bn; ?></font></b></div>
    </td>
    <td width="17%" height="2"> 
      <div align="center"><b><font face="Trebuchet MS" size="1" color="#000000"><?php echo $pn; ?></font></b></div>
    </td>

This is what I have on the drop menu:

<form method="POST" action="process.php" target="main" name="sort">
<p align="center"><b><font face="Tahoma" size="2">Sort By:</font></b>
<select size="1" id="id1" name="D1" style="font-family: Tahoma; font-size: 8pt">
<option value="id">Bloom Id</option>
<option value="bn">Bloom Name</option>
<option value="pn">Pod Name</option>
<option value="pln">Pollen Name</option>
<option value="Hybrid">Hybridiser</option>
<option value="origin">Origin</option>
<option value="gro">Grower</option>
</select>
<input type="submit" value="Submit" name="B1" style="font-family: Tahoma; font-size: 8pt">
</p>

kulrom

$sql="SELECT * FROM ihsreg ORDER BY '$_POST[D1]' ASC";

Adding 'ASC' or 'DESC' at the end of statement you are telling how you want to sort the fetched data

HTH
Regards 😉

MarkR

You should not have quotes around the name of the column to sort by.

Additionally, you should DEFINITELY check the sort thing for validity, otherwise you open a GAPING security hole in your app.

Anything being put into a SQL query needs to be escaped and/or rigorously checked. My suggestion is to have an array of allowed values, and to have the script drop out if it isn't one of them.

Mark

jd57

I have tried both suggestions, nothing seems to work.
Any other suggestions?

Roger_Ramjet

That is because you are not returning a valid column name from you select options. Your data access says that the column name is $sql -> Pollen_Name yet your option will return 'pln'. Never going to work without the correct column name.

kulrom

at least you know the correct statement:

SELECT * FROM Table ORDER BY column ASC

jd57

Thank you so much for your help 😃