Passing Database Field ID's Run SQL Depending on the Fields Value - php

Question

I'm trying to build a CMS where I can click a star icon and it will change the art_featured value in my database, so say if art_featured value is 0 and I click my star icon I want to change the value of the field from 0 to 1. I kind of have it working but I don't know how to pass the art_featured value, usually I would just us the id on my span but I'm already using that so I can tell which article I need to change, so how can I get the value of art_featured to my SQL statement so I can run a if and else statement and then run a certain SQL statement depending on the value of art_featured,
Thanks in advance for any help!
TABLE
art_id art_title art_company art_featured
1 lorem 1 lorem ipsum 1 1
2 lorem 2 lorem ipsum 2 0
HTML/PHP
<section class="row">
<?php
$sql_categories = "SELECT art_title, art_company, art_id, art_featured FROM app_articles";
if($result = query($sql_categories)){
$list = array();
while($data = mysqli_fetch_assoc($result)){
array_push($list, $data);
}
foreach($list as $i => $row){
?>
<div class="row">
<div class="column two"><p><?php echo $row['art_title']; ?></p></div>
<div class="column two"><p><?php echo $row['art_company']; ?></p></div>
<div class="column one"><span id="<?php echo $row['art_id']; ?>" class="icon-small star"></span></div>
</div>
<?php
}
}
else {
echo "FAIL";
}
?>
</section>
jQuery
$(".star").click(function(){
var art_id = $(this).attr('id');
$.ajax({
type: "POST",
data: {art_id:art_id},
url: "ajax-feature.php",
success: function(data){
if(data != false) {
}
else {
}
}
});
});
mySQL / PHP
if(isset($_POST['art_id'])) {
$sql_articles = "UPDATE `app_articles` SET `art_featured` = 1 WHERE `art_id` =".$_POST['art_id'];
if(query($sql_articles)) {
echo "YES";
}
else {
echo "NO";
}
}
else {
echo "FAIL";
}

Answer 1

$sql_detail = "SELECT * FROM app_articles
WHERE art_id = " . $_POST['art_id'];
$sql_result = mysql_query($sql_detail);
if(mysql_num_rows($sql_result) > 0) { // the art_id supplied exists
while($sR = mysql_fetch_array($sql_result)) {
$art_title = $sR['art_title'];
$art_company = $sR['art_company'];
$art_featured = $sR['art_featured];
// Do whatever you want with these variables
}
} else { // the art_id supplied does not exist
}
It's unsafe to pass the $_POST['art_id'] directly into a SQL statement, so you should probably read up on data sanitation. But this should do.