取得SQL语法错误

Question

I am trying to get the two values from my application in my php code. but before doing it I am trying to check through URL. But my problem is if give the values manual I am getting right output but when I check it by passing the values I am getting an syntax error. Can any one help me in solving this.

<?php
$hostname_localhost ="localhost";
$database_localhost ="mobiledb";
$username_localhost ="root";
$password_localhost ="";
$localhost = mysql_connect($hostname_localhost,$username_localhost,$password_localhost)
or
trigger_error(mysql_error(),E_USER_ERROR);
 $response = array();
mysql_select_db($database_localhost, $localhost);

$day = $_POST['day'];
$Q = $_POST['Qno'];


    // get a product from products table
$result = mysql_query("SELECT $Q FROM `Questions` WHERE `day`='$day'") or die(mysql_error()); 
    //echo $result;

if (mysql_num_rows($result) > 0) {
    // looping through all results
    // products node
    $response["question"] = array();

    while ($row = mysql_fetch_array($result)) {
        // temp user array
        $product = array();


        $product["question".$i] = $row["$Q"];

     $i = $i + 1;

     // push single product into final response array
        array_push($response["question"], $product);


    }


    // success
    $response["success"] = 1;

    // echoing JSON response
    echo json_encode($response);
} else {
    // no products found
    $response["success"] = 0;
    $response["message"] = "No users found";

    // echo no users JSON
    echo json_encode($response);
} 



?>

Answer 1

I am trying to check through URL

By this I assume you mean you are trying to go to the url:

http://localhost/yoursite/yourpage?Qno=5&day=thing

In that case, those variables will be accessed as $_GET['Qno'] and $_GET['day'] .

You can use $_REQUEST['Qno'] and $_REQUEST['day'] to receive the variables both ways. Of course, your application has so many security holes I won't even touch.

Answer 2

I would try escaping your values. will possibly fix your error and also protect you somewhat from SQL Injection which you should google and read.

$day = mysql_real_escape_string($_GET['day']);
$Q = mysql_real_escape_string($_GET['Qno']);

In this example, we use $_GET because you are trying to obtain the value directly from the URL.

Also, we escape the string to make sure we don't break our string syntax and inject bad monsters into your database!

ALSO: Mysql_ functionality is discontinued and you should stop using it. Read the big red box here: http://php.net/manual/en/function.mysql-query.php