Question

I have a MySQL query like this written in PHP:

$merkki = $_GET["merkki"];
// Retrieve all the data from the table 
//to show models based on selection of manufacturer

$result = mysql_query("SELECT * FROM Control_Mallit WHERE merkki_id = $merkki")
or die(mysql_error()); 
echo '{';
while($row = mysql_fetch_array($result)){
    echo '"' . $row['id'] . '"' . ":" . '"' . $row['malli'] . '"';
}
echo '}';

Result is correct, but how I can get a comma after each record? If I echo (,) after each row my code doesn’t work. I need it formatted as described below.

{
    "":"--",
    "series-1":"1 series",
    "series-3":"3 series",
    "series-5":"5 series",
    "series-6":"6 series",
    "series-7":"7 series"
}

What’s the best way to do this?

Answer 1

Immediately stop using your code. It is vulnerable to SQL injection. Think of what would happen if the value of merkki was 1 OR 1=1. The statement would return all records:

SELECT * FROM Control_Mallit WHERE merkki_id = 1 OR 1=1

You need to bind parameters to your query using mysqli_ or PDO functions (mysql_ functions are being deprecated. Also, use a column list and do not SELECT *.

Here is a possible solution using mysqli_ (not tested):

<?php
$link = mysqli_connect('localhost', 'my_user', 'my_password', 'world');

/* check connection */
if (!$link) {
    printf("Connect failed: %s\n", mysqli_connect_error());
    exit();
}

$array = array();

/* create a prepared statement */
$stmt = mysqli_prepare($link, "SELECT id, malli FROM Control_Mallit WHERE merkki_id = ?");

/* bind parameters for markers */
mysqli_stmt_bind_param($stmt, 'i', $_GET[merkki]);

/* execute query */
$result = mysqli_stmt_execute($stmt);

/* fetch associative array */
while ($row = mysqli_fetch_assoc($result)) {
    $array[] = '"' . $row['id'] . '"' . ":" . '"' . $row['malli'] . '"';
}

/* free result set */
mysqli_free_result($result);

/* close connection */
mysqli_close($link);

echo '{' . implode(',', $array) . '}';

?>

---

Edit

Following your original code, this solution should work:

$merkki = $_GET["merkki"];
$array = array();
// Retrieve all the data from the table to show models based on selection of manufacturer
$result = mysql_query("SELECT * FROM Control_Mallit WHERE merkki_id = $merkki")
or die(mysql_error()); 
while($row = mysql_fetch_array($result)){
    $array[] = '"' . $row['id'] . '"' . ":" . '"' . $row['malli'] . '"';
}
echo '{' . implode(',', $array) . '}';