GET request - unable to do a SELECT statement from DB - php

Question

I will be sending a request to the PHP code through a GET request. it will have several parameters passed. I will be using these parameters in the WHERE clause of my select statement.
GET REQUEST
http:// localhost/server/person.php?Id=1&age=12&hieght=100
PHP code
<?php
$connection = mysql_connect("localhost","user","pwd");
if (!$connection )
{
die('FAIL: ' . mysql_error());
}
mysql_select_db("db", $connection );
$result = mysql_query("SELECT * FROM Person where hieght='$_GET[hieght]");
$num_rows = mysql_num_rows($result);
?>
i think my PHP code is wrong. I am not sure if this is the way to grab variables from a GET request.

Answer 1

To get a variable from $_GET use, as an example to get height from $_GET array you can write
$height=$_GET['height'];
so you can write
$result = mysql_query("SELECT * FROM Person where hieght='".$hieght."'");
or you can write
$result = mysql_query("SELECT * FROM Person where hieght='".$_GET['height']."'");
Update:
Use mysql_real_escape_string to prevent sql injection, like
$height=$_GET['height'];
$result = mysql_query("SELECT * FROM Person where hieght='".mysql_real_escape_string($hieght)."'");
or
$result = mysql_query("SELECT * FROM Person where hieght='".mysql_real_escape_string($_GET['height'])."'");

Answer 2

$result = mysql_query("SELECT * FROM Person where hieght='".$_GET['hieght']."'");
A good debug technique when you are feeling your your is to put the SQL into a string
that you can log and see if it is what you expected.
Using mysql_error() after the query may have given you a hint too...
$sql = "SELECT * FROM Person where hieght='".$_GET['hieght']."'";
$result = mysql_query($sql);
#Not for production code, but handy while learning - error goes into web server log.
error_log("SQL=$sql, error=".mysql_error());

Answer 3

You should be parsing input like that for injections:
<?php
$myHeight = mysql_reaL_escape_string($_GET['height']);
$connection = mysql_connect("localhost","user","pwd");
if (!$connection )
{
die('FAIL: ' . mysql_error());
}
mysql_select_db("db", $connection );
$result = mysql_query("SELECT * FROM Person where height=$myHeight");
$num_rows = mysql_num_rows($result);
?>
Secondly, you should also be using the PHP PDO object rather than the old mysql_query etc.

Answer 4

Use this
$height = $_GET['hieght'];
$result = mysql_query("SELECT * FROM Person where hieght='$height'");
Instead of
$result = mysql_query("SELECT * FROM Person where hieght='$_GET[hieght]");
Note that with this code it is very likely to be victim of sql
injection

Answer 5

you may also wanna use this concat:
mysql_query("SELECT * FROM Person where hieght='".$_GET['hieght']."'");