Select Multiple Ids from a table

Question

I want to select some id's based on url string but with my code it displays only the first. If i write manual the id's it works great.

I have a url like this http://www.mydomain.com/myfile.php?theurl=1,2,3,4,5 (ids)

Now in the myfile.php i have my sql connection and:

$ids = $_GET['theurl']; (and i am getting 1,2,3,4,5)

if i use this:

$sql = "select * from info WHERE `id` IN (1,2,3,4,5)";
$slqtwo = mysql_query($sql);
while ($tc = mysql_fetch_assoc($slqtwo)) {
    echo $tc['a_name'];
    echo " - ";
}

I am Getting the correct results. Now if i use the code bellow it's not working:

$sql = "select * from info WHERE `id` IN ('$ids')";
$slqtwo = mysql_query($sql);
while ($tc = mysql_fetch_assoc($slqtwo)) {
    echo $tc['a_name'];
    echo " - ";
}

Any suggestions?

What is $ids? Note that because you've enclosed it in quotes, MySQL will treat it as a single item, so '1, 2' will return items with an ID of 1, 2. — andrewsi
– andrewsi, Commented Dec 24, 2013 at 14:17
You may want to research SQL injection and PDO. Those will greatly improve your code. — Rayhan Muktader
– Rayhan Muktader, Commented Dec 24, 2013 at 14:20

Community · Accepted Answer · 2018-11-04 10:37:02Z

52

When you interpolate

"select * from info WHERE `id` IN ('$ids')"

with your IDs, you get:

"select * from info WHERE `id` IN ('1,2,3,4,5')"

...which treats your set of IDs as a single string instead of a set of integers.

Get rid of the single-quotes in the IN clause, like this:

"select * from info WHERE `id` IN ($ids)"

Also, don't forget that you need to check for SQL Injection attacks. Your code is currently very dangerous and at risk of serious data loss or access. Consider what might happen if someone calls your web page with the following URL and your code allowed them to execute multiple statements in a single query:

http://www.example.com/myfile.php?theurl=1);delete from info;--

edited Nov 4, 2018 at 10:37

CommunityBot

11 silver badge

answered Dec 24, 2013 at 14:17

Jeremy Smyth

23.6k2 gold badges57 silver badges66 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

AlexP Over a year ago

+1 I think you should add the obligatory warning of using $ids = $_GET['theurl'] directly

flaviut Over a year ago

This answer is unfortunately vulnerable to SQL injection

Saharsh Shah · Accepted Answer · 2013-12-26 04:44:49Z

3

You can also try FIND_IN_SET() function

$SQL = "select * from info WHERE FIND_IN_SET(`id`, '$ids')"

OR

$SQL = "select * from info WHERE `id` IN ($ids)"

edited Dec 26, 2013 at 4:44

answered Dec 24, 2013 at 14:20

Saharsh Shah

29.1k9 gold badges53 silver badges85 bronze badges

3 Comments

flaviut Over a year ago

This answer is unfortunately vulnerable to SQL injection

user1689987 Over a year ago

@flaviut you are assuming the ids var isn't sanitized

flaviut Over a year ago

doing this properly using mysqli_prepare is free, and does not depend on both writing the sanitation code correctly (many times it is wrong) and making sure no one accidentally forgets to sanitize data in future code (impossible).

Collectives™ on Stack Overflow

Select Multiple Ids from a table

2 Answers 2

2 Comments

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related