如何为表中的所有查询创建动态php页面

Question

I'm trying to retrieve dynamic query PHP pages. First page passing values of city or id next page by post method.

I know here sql injection can done. but im using in it on private network and every user session is tracked. and table1 is protected.

Table looks like this:

TABLE1

-----------------------------------------------------
1     select * from tablename1 where ID = $id
2     select * from tablename1 where city = $city
2     select * from tablename1 where ID = $id  and city = $city
-----------------------------------------------------

Now I run page contain code:

    $id = $_POST["id"];
    $city= $_POST["city"];
    $tabledata = mysql_query("SELECT * FROM table1 ");
    $a=mysql_fetch_row($tabledata );

    $query_table=$a['1']; // retrieve sql query from table1 which stored in 2nd column
    echo " $query_table"; // display query
    $result = mysql_query($query_table);

    while ($field = mysql_fetch_row( $result) )
    {
        echo "<td> $field[1] </td>";
    }

Now, the problem is that I can't get results. $result is empty?

How pass $city or $id value to query?

But if I remove WHERE condition from TABKE1 then it works well. So, how can I make for WHERE condition to pass parameters?

how can i do this . any other option here to call stored query on 1 table and process it on other page and oher table

Answer 1

If you want the result with ID or City

mysql_query("SELECT * FROM table1 WHERE ID = '$id' OR city = '$city'");

and If you want with both mandatory

mysql_query("SELECT * FROM table1 WHERE ID = '$id' AND city = '$city'");

Answer 2

The query in table1 should be like this

-----------------------------------------------------
1     select * from tablename1 where ID = '".$id."'
2     select * from tablename1 where city = '".$city."'
3     select * from tablename1 where ID =  '".$id."'  and city =  '".$city."'
-----------------------------------------------------

and proceed further with your coding and it will show you the result.

OPTION 2:

Table 1:

-----------------------------------------------------
1     select * from tablename1 where ID =  
2     select * from tablename1 where city =  
-----------------------------------------------------

and change in php code like this

$query_table=$a['1']." '".$id."'" ;

or

$query_table=$a['2']." '".$city."'" ;

OPTION 3:

Table 1:

-----------------------------------------------------
1     select * from tablename1  

-----------------------------------------------------

and change in php code like this

$query_table=$a['1']." where ID = '".$id."'" ;

or

$query_table=$a['1']." where ID = '".$id."' AND city = '".$city."' " ;