[PHP] Why does this SQL not work?

[Conrad11]

Hi there,

This sql statement seems to just return "category" despite the fact its a SMALLINT(3) field.

I have checked spelling and variables so its nothing to do with that.

$result = mysql_query("SELECT 'id','name','link','category' FROM software ORDER BY 'id' DESC LIMIT $offset,$rowsPerPage") or die('Error1, query failed');

if ( mysql_num_rows($result) > 0 ) {
	while($row = mysql_fetch_array($result, MYSQL_ASSOC))
	{
		WriteRow($row['id'],$row['name'],$row['link'],$row['category'],$tabs);
	}

function WriteRow($id,$name,$link,$category,$tabs){
	echo $category;
}

Why is that? and how do I fix it?

Thanks.

 

[Conrad11]

Use backticks (`) to quote identifiers in SQL; as it is you're just selecting strings.

SELECT `id`, `name`, `link`, `category` FROM `software` ORDER BY `id` DESC LIMIT $offset, $rowsPerPage

LOL - knew i was rusty - didn't think i was that rusty.

Thanks mate.

 

[Conrad11]

Whilst I am here, this is ok to do isn't it? (security):

if(intval($_GET['category'])){
	$getCat = "WHERE `category` = " . intval($_GET['category']) . " ";
}else{
	$getCat = "";
}

...and then inserting that into the middle of an SQL statement.