How to arbitrariarly sort MySQL result set?

Php mysql syntax help?

• basically i get the following error returned "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1" and my code is " <?php include'conn.php'; $value=$_post['usid']; $query="SELECT * FROM users WHERE uid =$value "; $result = mysql_query($query) or die(mysql_error()); $info = mysql_fetch_array($result); $id = $info['UID']; $name = $info['username']; $pass = $info['password']; echo '<br>'; echo '<table border="1">'; echo '<tr><td>ID:</td>'; echo '<td>'; echo $id; echo '</td><br>'; echo '<td>username:</td><td>'; echo $name; echo '</td>'; echo '<td>password:</td><td>'; echo $pass; echo '</td>'; ?>" how ever when the script has a set id to lookup it works fine so im a bit confused I.e this works " <?php include'conn.php'; $value=1; $query="SELECT * FROM users WHERE uid =$value "; $result = mysql_query($query) or die(mysql_error()); $info = mysql_fetch_array($result); $id = $info['UID']; $name = $info['username']; $pass = $info['password']; echo '<br>'; echo '<table border="1">'; echo '<tr><td>ID:</td>'; echo '<td>'; echo $id; echo '</td><br>'; echo '<td>username:</td><td>'; echo $name; echo '</td>'; echo '<td>password:</td><td>'; echo $pass; echo '</td>'; ?>" and the form elements name is usid any help will be great

• Answer:

  To access HTTP parameters, you need to use capital letters, eg -> $_POST['usid'] instead of $_post['usid'] Also, your SQL above will fail if the parameter is missing (or submitted via a GET request). Generally, it's more flexible to use $_REQUEST['usid'] Worse, you want to cast the $_POST['usid'] to an (int) value rather than simply using it. If a malicious user manually posted a usid value of '1; DROP TABLE users' you would lose all your user data.