Question

The query below works correctly if I REMOVE the “and table.field = ‘$filter’ OR table.field=’$otherfilter'”. If i add this part then it shows me results for people I am not authorized to see. I definetely need to add that part so it shows me filtered results. How do I structure this so it shows me the correct results using: and table.field = ‘$filter’ OR table.field=’$otherfilter’

Code:

  //$filter = "23943409"
    $filter2 = "$username";


  $sql = "SELECT table.field, table2.field, table.field, table.field,
  table.field, table.field, table.field FROM table 
  LEFT JOIN table2 ON table.field = table2.field 
  WHERE table.field='$id' and table.field='$id' 
  and table.field = '$filter' OR table.field='$otherfilter' 
  ORDER BY table.id DESC LIMIT 0, 3";

  $result=mysql_query($sql);

  $query = mysql_query($sql) or die ("Error: ".mysql_error());

  if ($result == "")
  {
  echo "";
  }
  echo "";


  $rows = mysql_num_rows($result);

  if($rows == 0)
  {
  print("");

 }
 elseif($rows > 0)
 {
 while($row = mysql_fetch_array($query))
 {

 $field = $row['field'];

 print("$field");
 }

 }

Answer 1

Try AND (table.field = '$filter' OR table.field = '$otherfilter'). Note the parenthesis around the clause. I’m assuming you have obfuscated the code and replaced the actual field names with “field”.