Question

I have following PHP script. I want to count and print comments for each article.

The id for each article can be “recalled” by this: <?php echo $listing['Listing']['listing_id'];?> (this return the contentid number)

Now, I have this script:

<?php
          $db =& JFactory::getDBO();
          $query = "SELECT COUNT(comments) AS totalcount WHERE contentid = ????? ";
          $db->setQuery($query);
          $count = $db->loadResult();
echo ($count); ?>

I tried to add in WHERE clause this:

"... WHERE contentid = {$listing['Listing']['listing_id']}"

but $count returns “0” zero.
How can I add this variable in the WHERE clause?

Thanks in advance!

Answer 1

In the case of an integer:

$query = "SELECT
    COUNT(comments) AS totalcount
WHERE
    contentid = " . ((int) $listing['Listing']['listing_id']);

In the case of a string:

$query = "SELECT
    COUNT(comments) AS totalcount
WHERE
    contentid = " . mysql_real_escape_string($listing['Listing']['listing_id']);

The biggest thing to be weary of is SQL injection. This makes your queries safe. The explicit cast to int will ensure an int value is passed, even if the value is erroneous, at least you wont be open to any attack.