Help! Passing SQL statement as var

[Anon]

I need to pass the SELECT statement below to another page. When i pass it as below it works fine, however the statement is going to be different every time so i wanted to assign the SQL to a variable.

<input type=hidden name="query" value="SELECT * FROM tblHousing">

i've tried this for hours.....

$sql = "SELECT * FROM tblHousing";

<input type=hidden name="query" value="<?php echo $sql ?>">

if anyone can tell me whats wrong i'd be very grateful cause i have a deadline of tomorrow to meet...
thank you.

[toma42]

input type=hidden name="query" value="<?php echo $sql ?>">

use echo htmlspecialchars($sql);

Oh, and by the way, this is a stupid and very very insecure thing to do. Imagine I look at your html and see this field then to a get or create a page to post to your action="" script with query="delete from tblHousing"

[Anon]

No comments from the Peanut Gallery

Tom Anderson wrote:

input type=hidden name="query" value="<?php echo $sql ?>">

use echo htmlspecialchars($sql);

Oh, and by the way, this is a stupid and very very insecure thing to do. Imagine I look at your html and see this field then to a get or create a page to post to your action="" script with query="delete from tblHousing"

[Anon]

you could always encrypt the SQL query:

try <input type=hidden name="query" value="<?= base64_encode('SELECT * FROM tblHousing') ?>"

Then in the next page decrypt it by using:
$query = base64_decode($query);

It makes it easy to pass via HTTP GET and it's not as obvious to the web user (though it's still not 100% secure)

[Anon]

well just don't include the "select ".
so noone could get a "delete from ..." executing cause your script would ammend "select " to the start.

but, generally, passing a sql statement is a really weird technique 😉