MySQL Query using $_GET

Ok, maybe I'm a bit overtired, but I can't understand why this isn't working! I have a comments box on my website, with profiles for people who post. I want to show just their posts in the profile. Their profile page is userinfo.php?user=(whatever)

This query is failing:

$query = "SELECT message,`date`,ip,name,website,id 
          FROM `guestbook_message`
          W开发者_开发百科HERE name=" . intval($_GET['user']) . "
          AND deleted=0
          ORDER BY `date` DESC";

---

You are getting the name of the user and casting it directly to integer and then comparing it with name. This does not make sense.

If the $_GET['user'] is the ID of the user, then compare it with the ID and not with the name.

If $_GET['user'] is the username of the user, then you have to put the quotes around the username value. As UserName value is a string, you need to encapsulate it in quotes and remove the intval. Do it like this:

 $query = "SELECT message,`date`,ip,name,website,id
           FROM `guestbook_message`
           WHERE name='" . mysql_real_escape_string($_GET['user']) . "'
               AND deleted=0
           ORDER BY `date` DESC";

---

try this:

$name = intval($_GET['user']);

$query = "SELECT message,date,ip,name,website,id 
          FROM guestbook_message 
          WHERE name='" .$name. "' 
          AND deleted=0 
          ORDER BY date DESC";
$result = mysql_query($query) or die(mysql_error());

---

Assuming you're using mysql_query() to execute the query, have you checked if the query succeeded?

$query = "SELECT ...";
$result = mysql_query($query) or die(mysql_error());

Doing this will force the script to abort if the query fails and tell you why the query failed.

---

One thing to note that using $_GET directly in your query leaves you open to SQL injection attacks.

Consider cleaning your input prior to building your SQL statement, or use PDO / Prepared statements.