从sql查询中的url获取id [duplicate]

Question

This question already has an answer here:

• PHP parse/syntax errors; and how to solve them? 17 answers

I have an sql query to fetch data from database in php. I am using the limit to limit data. I need to limit data according to the id in the url.

How can I call the id in the sql query. I have tried the following but it's showing an error:

$response=mysqli_query($con,"select * from prometric ORDER BY RAND() LIMIT echo $_GET['id']; ");

and the error is

Parse error: syntax error, unexpected '' (T_ENCAPSED_AND_WHITESPACE), expecting '-' or identifier (T_STRING) or variable (T_VARIABLE) or number (T_NUM_STRING) in C:\xampp\htdocs urse\prometricajax.php on line 14

</div>

Answer 1

It could be, worse, if you got it 'right' there would be an SQL injection vulnerability in your application.

die('the following appears to work but is unsafe');
$response=mysqli_query($con,"select * from prometric ORDER BY RAND() LIMIT $_GET[id]; ");

I've got die above because noone should use such code ever.

eg: called as

https://you.example.com/thing.php?id=1%3btruncate+prometric%3bcommit

could delete all the content from the prometric table.

At a bare minimum do this.

$response=mysqli_query($con,"select * from prometric ORDER BY RAND() LIMIT ".(0+$_GET['id']));

the above forces $_GET['id'] to a number by adding 0, this should block all injection attacks, the worst they can do is use a big number and produce an error for number too big, etc.

but probably a better sanitization is called for. Eg: copy $_GET['id'] into a variable, and check that is in an acceptable range before using it in SQL.