0

I have the following MySQL

    $tutorial = $database->query(
        'SELECT ' . 
            'tutorial.*, ' . 
            'apps.*'.
                'FROM ' . 
                    $database->db_prefix . 'tutorial, ' . 
                    $database->db_prefix . 'apps ' . 
                        'WHERE ' .
                            'apps.title = "' . $name . '" AND apps.id = tutorial.app AND tutorial.relation = "' . $user['id'] . '"'
    );

I want to get the row where apps.title is equal to $name and then get all tutorials based on that retrieved apps id. This acts as a link between the two tables.

Is the above going to work?

in particular:

'apps.title = "' . $name . '" AND apps.id = tutorial.app AND tutorial.relation = "' . $user['id'] . '"'
6
  • You really need to read up on how to properly escape SQL parameters. This is dangerously insecure.
    – tadman
    Oct 10, 2012 at 15:45
  • ay? how is this dangerously insecure lmao? $name contains a posted variable that i have validated. :s don't be silly.
    – Jimmyt1988
    Oct 10, 2012 at 20:46
  • Validation is not sufficient. You must escape any and all values you are putting into your SQL. If it's not obvious it's escaped, you're doing it wrong. If you take a casual approach, you will get burned. You won't be laughing when someone with an automatic injection tool hijacks your site.
    – tadman
    Oct 11, 2012 at 14:25
  • so the fact that my $name is escaped further up in my code doesn't mean anything? lol. I can send you the whole php script if you want... it won't fit here though ;)
    – Jimmyt1988
    Oct 11, 2012 at 16:08
  • In stackoverflow you are required to present short bits of code specific to your question. I think you're going to have to understand this in the future.. as you can see I haven't included the declaration of $name in my code as it is not necessary for this question.
    – Jimmyt1988
    Oct 11, 2012 at 16:10

2 Answers 2

0

I want to get the row where apps.title is equal to $name and then get all tutorials based on that retrieved apps id.

From the query you posted above, I think you can JOIN the two tables using the app field something like:

SELECT t.*
FROM tutorials t 
INNER JOIN apps a ON t.app = a.app
WHERE a.title = $name AND t.relation = $user['id']

Or:

SELECT 
  tutorial.*
FROM tutorial
WHERE toutorial.app IN
(
    SELECT app FROM apps WHERE apps.title = $name AND app IS NOT NULL
) AND tutorial.relation = $user['id'] 
2
  • Genius :D, the second one works great!! Is there any benefit to using join?
    – Jimmyt1988
    Oct 10, 2012 at 14:18
  • @JamesT - Yes, in case you want to select more rows from the second joined table and other benefits. Not that when using IN watch out the NULL values of the app values coming from apps table. If there is one app with NULL value, thats why I added IS NOT NULL in my edit, your query won't return any thing. JOIN is safe and I think in most cases is faster. Oct 10, 2012 at 14:21
0

No, it's not going to work. See the Mysql JOIN syntax.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.