using sent variables in a url?

rithym_tech

ok i have a code written to assign a specific ID linking to a certain file in my database:

echo "<td>"."<a href=writings_open.php?ID=".$row[0]." target=middle3>".$row[1]."</a>"."</td>";

<a href=writings_open.php?ID=".$row[0]." target=middle3>
this is where the link is made depending on what row...
when you click the link it looks like this:

writings_open.php?ID=2 for example

this is the code on writings_open.php :

<html>

<body>
<?php

$var = $_GET['ID'];

$host = "host";
$user = "user";
$pass = "pass";
$db = "db";
$connection = mysql_connect($host, $user, $pass);
mysql_select_db($db) or die ("Unable to select database!");
$query = 'SELECT * FROM writings WHERE ( ID = $var )';
$result = mysql_query($query) or die ("Error in query: $query. ".mysql_error());

echo $result[2];

mysql_close($connection);

?>
</body>

</html>

what im trying to do is open a page and have a certain column from certain numbered row in my table displayed on teh page... i need help mostly with the error:

Error in query: SELECT * FROM writings WHERE ( ID = $var ). Unknown column '$var' in 'where clause'

thanks for the help in advanced!

Drakla

You're using single quotes, so $var isn't being expanded. Use this

$query = 'SELECT * FROM writings WHERE ID = '.(int)$var;

Assuming your ID is an integer this also protects you from injection attacks.