Using result from one query to as a WHERE clause

Question

I am trying to get the postcode with one query and use it in the where clause for another query.

<?php
$mobile = '07790807055';
//$mobile = $_POST['mobile'];


mysql_connect("", "", "") or die(mysql_error());
mysql_select_db("") or die(mysql_error());

$query =("SELECT POSTCODE FROM appregistration WHERE MOBILE_NUMBER = '$mobile'");
$result = mysql_query ($query) or die ("Unable to connect. " . mysql_error());
$row = mysql_fetch_array($result);
$postcode = $row['POSTCODE'];
/// gets postcode from appregistration table 

$sql=mysql_query("SELECT INCIDENT_ID, INVESTIGATION,TYPE_OF_INCIDENT,DESCRIPTION FROM appreports WHERE POSTCODE = '$postcode'");
//uses postcode from ppregistration table  to find info from appreports table 

while($row=mysql_fetch_assoc($sql)) $output[]=$row;

print(json_encode($output));

mysql_close();
?>

Answer 1

Why not use a JOIN rather than running two queries:

SELECT `INCIDENT_ID`, `INVESTIGATION`, `TYPE_OF_INCIDENT`, `DESCRIPTION`
FROM `appreports`
INNER JOIN `appregistration` ON `appreports`.`POSTCODE` = `appregistration`.`POSTCODE`
WHERE `appregistration`.`MOBILE_NUMBER` = '$mobile'

For example:

<?php
$mobile = '07790807055';

mysql_connect("", "", "") or die(mysql_error());
mysql_select_db("") or die(mysql_error());

$sql = mysql_query("SELECT `INCIDENT_ID`, `INVESTIGATION`, `TYPE_OF_INCIDENT`, `DESCRIPTION`
                    FROM `appreports`
                    INNER JOIN `appregistration` 
                    ON `appreports`.`POSTCODE` = `appregistration`.`POSTCODE`
                    WHERE `appregistration`.`MOBILE_NUMBER` = '$mobile'");

while($row=mysql_fetch_assoc($sql))
{
    $output[] = $row;
}

print(json_encode($output));

mysql_close();
?>

Answer 2

Leaving aside the glaring SQL injection vulnerability, the dubious commenting (the redundant punctuation) in the code, the deprecated API and the reliance on default parameters in the call to mysql_fetch_array(), the unnecessary split query, and a few other things which should be picked up in any code review but which don't actually affect the functionality....You don't actually say what happens when you run the code.

Does the first query return a result?

What happens when you run the queries via the mysql CLI or phpmyadmin?

UPDATE

this is the error i am getteing if i use join "Parse error: syntax error, unexpected '`' on line 20

OK, it is a SQL injection bug that's causing the problem - I assume that this is line 20:

$sql=mysql_query("SELECT INCIDENT_ID, INVESTIGATION,TYPE_OF_INCIDENT
      ,DESCRIPTION FROM appreports WHERE POSTCODE = '$postcode'");

$postcode contains one or more single quotes. Escape it:

    $sql=mysql_query("SELECT INCIDENT_ID, INVESTIGATION,TYPE_OF_INCIDENT
      ,DESCRIPTION FROM appreports WHERE POSTCODE = '".
      mysql_real_escape_string($postcode) . "'");