how to solve PHP MYSQL ORDER BY error in mysql_query

Question

I have a problem with mysql_query with request with ORDER BY come from a parameter function

All parameters is already escaped and is hardcoded by me (not from a user forms or whathever) and this function serve to generate an HTML Select List

This is an example of by BD

BD name = Year and table is :

id------fr-----en
1914 1914 1914
1915 1915 1915
...
2014 2014 2014

it is easy id = fr (for french) = en = (for english) = Year

this is my function with parameters :

function generateSelectList($bd, $table, $name, $id, $language, $orderBy, $print0, $tabindex, $class, $style, $label, $value0, $title)

so when i use this function :

<?php generateSelectList("gaiurba_GayUrban", "Year", "Year", "ID", $_SESSION['LanguageCode'], "", "true", "21", "splash_small required", "", "label_year", "", " "); ?>

in my HTML code everything is ok and the select list start at year 1914 $orderBy parameter is empty ""

So, i need to starting my select list from 2014 ( ORDER BY id DESC )

I try to use this :

<?php generateSelectList("gaiurba_GayUrban", "Year", "Year", "ID", $_SESSION['LanguageCode'], "id DESC", "true", "21", "splash_small required", "", "label_year", "", " "); ?>

with $orderBy parameter = "id DESC" and mysql_query never execute and die.

This is the starting code for my function generateSelectList :

    try {
    $accessDb = new Connexion($bd);
    $connexion = $accessDb->openConnexion();

    if ($orderBy != "" || $orderBy != null) {
        echo $orderBy;
        $sql = "SELECT $id, $language FROM $table ORDER BY $orderBy";
    } else {
        $sql = "SELECT $id, $language FROM $table";
    }

    echo " sql = " . $sql;

    $resultat = mysql_query($sql) or die(mysql_error());
    $nbResultat = mysql_num_rows($resultat);

    echo '<select id="' . $name . '" class="' . $class . '" tabindex="' . $tabindex . '" name="' . $name . '" style="' . $style . '" title="' . $title . '">';

    while ($row = mysql_fetch_array($resultat)) { ... }

When I use my function without $orderBy parameter everything is ok and work fine. When I use trace log ( echo ) $orderBy = "id DESC" and my $sql = "SELECT ID, fr FROM Year ORDER BY id DESC";

I add echo just before $resultat = mysql_query($sql) or die(mysql_error()); and just after

On my website I see echo $orderBy , echo $sql echo AFTER and nothing after that if I use the version of generateSelectList without $orderBy parameter I see echo $orderBy, echo $sql , echo AFTER my HTML select list starting at year 1914 and echo AFTER.

When execute this $sql query directly in phpMyAdmin work fine!

It's really simple and I really don't understand why is not working.

Answer 1

您是否尝试过在要选择的字段上加上单引号？