Using $_GET in an INSERT statement

[NiallThistle]

Here's my code:

mysql_query("INSERT INTO val_variations (
variation_val, variation_num, variation_detail, variation_ins, variation_cost) 
VALUES(
[B]'".$_GET["val"]."',[/B] '".$_POST["varnum"]."', '".$_POST["vardetail"]."', '".$_POST["varins"]."', '".$_POST["varcost"]."') ")
or die(mysql_error());
echo "Variations submitted.<br><br>Please wait...";

The URL I use ends like this:

add.php?action=valuation_step2&val=9

I manage to retrieve the 'action' using get fine, but for some reason, this query does not retrieve the 'val' figure. Does anyone know what I'm doing wrong?

[leatherback]

personally I would always use only POST or GET; So, use 2 hidden variables in the form.

[bradgrafelman]

Try building the SQL query in a variable and pass that variable as the first parameter for mysql_query(). That way, you can echo out the SQL query as it was sent to the SQL server. Do that and show us the query that's being sent.

If the value doesn't appear in the query string, try adding the following to get some debug info:

var_dump($_GET);
var_dump($_SERVER['QUERY_STRING']);

and let us know what the output is.