PHP: Problem in a SQL statement when using a String Parameter

Question

$befal = mysql_query("SELECT * FROM users WHERE username = $_GET[username]");
$rad = mysql_fetch_assoc($befal);

Equals

Warning: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in C:\profile.php on line 4

I have a user called Admin in the field username and it still dont work. profile.php?user=Admin...

This works if I use the ID though:

$befal = mysql_query("SELECT * FROM users WHERE user_id = $_GET[id]");
$rad = mysql_fetch_assoc($befal);

What can be the problem?

Thanks

Answer 1

Try it like this:

$befal = mysql_query("SELECT * FROM users WHERE username = '$_GET[username]'");

You have to encapsulate a string parameter in apostrophes.

[UPDATE]

Just like cletus and Olaf pointed out, with the above sql statement you are very prone to SQL Injection. Check out their posted answers to see what I mean.

Answer 2

Now that you've got your answer, try entering

Something' OR '1' = '1

as username - you've managed to produce a nice SQL-injectable application.

Answer 3

Errr... that's a recipe for getting hacked. I would like to introduce you to SQL injection as characterized by this very funny yet poignant cartoon.

Try this instead.

$username = mysql_escape_string($_GET['username']);
$query = mysql_query("SELECT * FROM users WHERE username = '$username'");