MySQL Query使用$ _GET

Ok, maybe I'm a bit overtired, but I can't understand why this isn't working! I have a comments box on my website, with profiles for people who post. I want to show just their posts in the profile. Their profile page is userinfo.php?user=(whatever)

This query is failing:

$query = "SELECT message,`date`,ip,name,website,id 
          FROM `guestbook_message`
          WHERE name=" . intval($_GET['user']) . "
          AND deleted=0
          ORDER BY `date` DESC";

try this:

$name = intval($_GET['user']);

$query = "SELECT message,date,ip,name,website,id 
          FROM guestbook_message 
          WHERE name='" .$name. "' 
          AND deleted=0 
          ORDER BY date DESC";
$result = mysql_query($query) or die(mysql_error());

Assuming you're using mysql_query() to execute the query, have you checked if the query succeeded?

$query = "SELECT ...";
$result = mysql_query($query) or die(mysql_error());

Doing this will force the script to abort if the query fails and tell you why the query failed.

You are getting the name of the user and casting it directly to integer and then comparing it with name. This does not make sense.

If the $_GET['user'] is the ID of the user, then compare it with the ID and not with the name.

If $_GET['user'] is the username of the user, then you have to put the quotes around the username value. As UserName value is a string, you need to encapsulate it in quotes and remove the intval. Do it like this:

 $query = "SELECT message,`date`,ip,name,website,id
           FROM `guestbook_message`
           WHERE name='" . mysql_real_escape_string($_GET['user']) . "'
               AND deleted=0
           ORDER BY `date` DESC";

One thing to note that using $_GET directly in your query leaves you open to SQL injection attacks.

Consider cleaning your input prior to building your SQL statement, or use PDO / Prepared statements.