Php variable in MYSQL query

PHP
1

Good day to you all,
I’m working on a script which would read a url var and sort mysql table by the variable, but I always get the errore that :

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in DB_API/sort_column.php on line 13

Can somebody help me fix my problem. I think it’s the variable that is not use right in the MYSQL query (

$result = mysql_query("SELECT * FROM NHL_GBG_PLAYERS ORDER BY {$col}");

)

Here is my code :



<?php
$con = mysql_connect("localhost","sports","sports");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("sports", $con);

$col = $_POST['coll'];
$result = mysql_query("SELECT * FROM players ORDER BY {$col}");

while($row = mysql_fetch_array($result))
  {

  
  echo "<div style=\\"width:1090px; align-left:auto; margin-right:auto;\\">";
  echo "<div style=\\"float:left; width:30px; border:1px solid #000000; \\">" . $row['id'] . "</div>";
  echo "<div style=\\"float:left; width:100px; border:1px solid #cccccc;\\">" . $row['date'] . "</div>";
  echo "<div style=\\"float:left; width:100px; border:1px solid #cccccc;\\">" . $row['heure'] . "</div>";
  echo "<div style=\\"float:left; width:100px; border:1px solid #cccccc;\\">" . $row['lieu'] . "</div>";
  echo "<div style=\\"float:left; width:100px; border:1px solid #cccccc;\\">" . $row['assistance'] . "</div>";
  echo "<div style=\\"float:left; width:100px; border:1px solid #cccccc;\\">" . $row['adversaire'] . "</div>";
  echo "<div style=\\"float:left; width:100px; border:1px solid #cccccc;\\">" . $row['equipe'] . "</div>";
  echo "<div style=\\"float:left; width:100px; border:1px solid #cccccc;\\">" . $row['nom'] . "</div>";
  echo "<div style=\\"float:left; width:20px; border:1px solid #cccccc;\\">" . $row['b'] . "</div>";  
  echo "<div style=\\"float:left; width:20px; border:1px solid #cccccc;\\">" . $row['p'] . "</div>";
  echo "<div style=\\"float:left; width:40px; border:1px solid #cccccc;\\">" . $row['pts'] . "</div>";
  echo "<div style=\\"float:left; width:20px; border:1px solid #cccccc;\\">" . $row['l'] . "</div>";
  echo "<div style=\\"float:left; width:40px; border:1px solid #cccccc;\\">" . $row['mdp'] . "</div>";
  echo "<div style=\\"float:left; width:30px; border:1px solid #cccccc;\\">" . $row['bg'] . "</div>";
  echo "<div style=\\"float:left; width:30px; border:1px solid #cccccc;\\">" . $row['be'] . "</div>";
  echo "<div style=\\"float:left; width:40px; border:1px solid #cccccc;\\">" . $row['bea'] . "</div>";
  echo "<div style=\\"float:left; width:40px; border:1px solid #cccccc;\\">" . $row['bed'] . "</div>";
  echo "<div style=\\"float:left; width:40px; border:1px solid #cccccc;\\">" . $row['PM'] . "</div>";
  echo "</div><br>";  
  
  
  
  
  }

mysql_close($con);
?>

Thanks!

2

You just need to do some basic debugging.
What is the value of $_POST[‘col1’] ?
Store the query in a string and echo it, does it look right? Can you execute it in PhpMyAdmin?
after running the query echo mysql_error($con) to see what MySQL has to say about the problem.

If you’re trying to get the value from the URL query string you probably want $_GET not $_POST, and NEVER take user input and directly execute it in your SQL without validating and escaping it!