PHP / SQL-使用两个$ _GET语句有问题吗？

Question

I am trying to use two different $_GET statements (within the first two chunks of code) and then pass their values into a SQL statement (in the third chunk of code), however it is incorrectly working out for me. I am wondering if i'm using the the $_GET statement incorrectly?? Thanks for any and all help!

if (!(isset($_GET['companyselected']))) {
    $result = mysqli_query($db, "SELECT DISTINCT Company_ID, CompanyName " . "FROM Company");
    $fields = mysqli_fetch_fields($result);
    echo "<table style='width:900px'><tr>";
    foreach ($fields as $column) 
        echo "<th>" . $column->name . "</th>"; 
    echo "<th>Select Bus Company</th></tr>";
    while ($row = mysqli_fetch_assoc($result)) {
        echo "<tr>";
        foreach ($row as $field) echo "<td>" . $field . "</td>";
        echo "<td><a href=\"" . $_SERVER['PHP_SELF'] . "?companyselected=" 
            . $row['Company_ID'] . "\" style=\"color: green;\">Show Routes</a></td></tr>";
    }
    echo "</table>";
}

if (isset($_GET['companyselected'])) 
    {
        if ($result = mysqli_query($db, "SELECT DISTINCT RouteNum, RouteName FROM Route WHERE Company_ID = " . (int)$_GET['companyselected']))
            {
                $fields = mysqli_fetch_fields($result);
                echo "<table style='width:900px'><tr>";
                foreach ($fields as $column) 
                    echo "<th>" . $column->name . "</th>"; 
                echo "<th>Select Bus Company</th></tr>";
                while ($row = mysqli_fetch_assoc($result)) {
                    echo "<tr>";
                    foreach ($row as $field) echo "<td>" . $field . "</td>";
                    echo "<td><a href=\"" . $_SERVER['PHP_SELF'] . "?routeselected=" 
                        . $row['RouteNum'] . "\" style=\"color: green;\">Display Route</a></td></tr>";
                }
                echo "</table>";
            } 
    }

//error is within the $result variable below

if (isset($_GET['routeselected'])) 
    {
        $result = mysqli_query($db, "SELECT * FROM STOP INNER JOIN RouteStop ON Stop.Stop_ID = RouteStop.Stop_ID WHERE RouteStop.Route_ID = " . (int)$_GET['routeselected'] . " AND RouteStop.Company_ID = " . (int)$_GET['companyselected']);
        while ($row = mysqli_fetch_array($result))
            echo "{\"title\": '".$row['Stop_ID']."', \"lat\": '".$row['Latitude']."', \"lng\": '".$row['Longitude']."', \"description\": '".$row['StopName']."'},";
    }
  ?>

Answer 1

Try changing this line:

if ($result = mysqli_query($db, "SELECT DISTINCT RouteNum, RouteName FROM Route WHERE Company_ID = " . (int)$_GET['companyselected']))

to (add single quotes and remove int I would imagine):

if ($result = mysqli_query($db, "SELECT DISTINCT RouteNum, RouteName FROM Route WHERE Company_ID = '" . mysqli_real_escape_string($cxn, $_GET['companyselected']) . "'"))

where $cxn can be accessed if you include your 'connect.php' file.

Also try changing this line:

$result = mysqli_query($db, "SELECT * FROM STOP INNER JOIN RouteStop ON Stop.Stop_ID = RouteStop.Stop_ID WHERE RouteStop.Route_ID = " . (int)$_GET['routeselected'] . " AND RouteStop.Company_ID = " . (int)$_GET['companyselected']);

to:

$result = mysqli_query($db, "SELECT * FROM STOP INNER JOIN RouteStop ON Stop.Stop_ID = RouteStop.Stop_ID WHERE RouteStop.Route_ID = " . mysqli_real_escape_string($cxn, (int)$_GET['routeselected']) . " AND RouteStop.Company_ID = '" .  mysqli_real_escape_string($cxn, $_GET['companyselected']) . "'");

If the route numbers are not alphanumeric but only numeric, please remove the single quotes I have placed around the sql $_GETs in my proposed edits.

Answer 2

thank you so much for your responses! Come to find out, I had to concatenate the (int)$_GET['companyselected'] from the first result of a SQL query into the second result of the SQL query, and it is now working beautifully. Here is the code with the concatenation:

echo "<td><a href=\"" . $_SERVER['PHP_SELF'] . "?routeselected=" 
       . $row['RouteNum'] . "&companyselected=" . (int)$_GET['companyselected'] . "\" style=\"color: green;\">Display Route</a></td></tr>";

Thanks again!!