Question

$query = sprintf("SELECT * FROM sorular WEHERE test_id='%s' ORDER BY id LIMIT '%s', '%s'",
mysql_real_escape_string(htmlentities(stripslashes($testid))), 
mysql_real_escape_string(htmlentities(stripslashes($start))), 
mysql_real_escape_string(htmlentities(stripslashes($perpage))));

and I am getting error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘test_id=’1’ ORDER BY id LIMIT ‘4’, ‘2” at line 1

Answer 1

Limit and offset are always integer. Try this:

$query = sprintf("SELECT * FROM sorular WHERE test_id='%s' ORDER BY id LIMIT %s, %s",
mysql_real_escape_string(htmlentities(stripslashes($testid))), 
$start, 
$perpage);

Anyway, you filter variables in worst way. Integers are integres, use $int = (int) $maybeInteger;, strings – you do mysql_real_escape_string() and stripslashes() at the same time, this functions are familiar, look to manual. htmlentities() should be used after filtration.

As it was said, the correct answer is: WEHERE => WHERE.