PHP选择查询返回false

Question

I am having this piece of code:

$result = mysqli_query($con , 'SELECT * FROM messages WHERE group = "'.$_POST['group'].'" ORDER BY date '.$_POST['order'].'');

I don't understand why it is always returning me false. The variables $_POST['group'] and $_POST['order'] aren't empty .

$_POST['group']='PHP'
$_POST['order']='DESC'

The conecction to the database is corect too.

Answer 1

GROUP is a mysql reserved word and needs to be quoted using backticks;

SELECT * FROM messages WHERE `group` =  ...

You're also wide open to SQL injection, you should never add un-validated/un-escaped POST data in string format to your SQL. The safest way to do queries with user data is using prepared statements, or - as a less secure alternative - escape the data using mysqli_real_escape_string .

Answer 2

$result = mysqli_query($con , "SELECT * FROM messages WHERE group = '".mysqli_real_escape_string($_POST['group'])."' ORDER BY date '".mysqli_real_escape_string($_POST['order'])."'";

Try formatting the query like this and see if it helps your result. I also added mysqli_real_escape_string() to escape your input, as your query was wide open to SQL injection.

http://php.net/manual/en/mysqli.real-escape-string.php