Question

This is part of a android app… I have the php script working when I specify the mysql_query without using .$_POST[‘varname’]. To add search ability to the app using different parameters that are user definable I am trying to build the query in the PHP script from values that are passed from the app when the httpget is called… The Line of the php script looks likes this:

$result = mysql_query("SELECT * FROM businessdata WHERE '"
    . $_POST['varQuery2']."' =  '" 
    . $_POST['varQuery1']"'") 
    or die(mysql_error());

And then the method is as follows: (For Completeness here method is assigned the string value “GET” when this method is called)

    public JSONObject makeHttpRequest(String url, String method,
        List<NameValuePair> params, String value, String value2) {

    // Making HTTP request
    try {

        // check for request method
        if(method == "POST"){
            // request method is POST
            // defaultHttpClient
            DefaultHttpClient httpClient = new DefaultHttpClient();
           params.add(new BasicNameValuePair("varQuery2", value));
           params.add(new BasicNameValuePair("varQuery1", value2)); 
           HttpPost httpPost = new HttpPost(url);
            httpPost.setEntity(new UrlEncodedFormEntity(params));

            HttpResponse httpResponse = httpClient.execute(httpPost);
            HttpEntity httpEntity = httpResponse.getEntity();
            is = httpEntity.getContent();

        }else if(method == "GET"){
            // request method is GET
            DefaultHttpClient httpClient = new DefaultHttpClient();

            params.add(new BasicNameValuePair("varQuery2", value));
            params.add(new BasicNameValuePair("varQuery1", value2)); 
            String paramString = URLEncodedUtils.format(params, "UTF-8");
            url += "?" + paramString;
            HttpGet httpGet = new HttpGet(url);

            HttpResponse httpResponse = httpClient.execute(httpGet);
            HttpEntity httpEntity = httpResponse.getEntity();
            is = httpEntity.getContent();
        }           

    } catch (UnsupportedEncodingException e) {
        e.printStackTrace();
    } catch (ClientProtocolException e) {
        e.printStackTrace();
    } catch (IOException e) {
        e.printStackTrace();
    }

    try {
        BufferedReader reader = new BufferedReader(new InputStreamReader(
                is, "iso-8859-1"), 8);
        StringBuilder sb = new StringBuilder();
        String line = null;
        while ((line = reader.readLine()) != null) {
            sb.append(line + "\n");
        }
        is.close();
        json = sb.toString();
    } catch (Exception e) {
        Log.e("Buffer Error", "Error converting result " + e.toString());
    }

    // try parse the string to a JSON object
    try {
        jObj = new JSONObject(json);
    } catch (JSONException e) {
        Log.e("JSON Parser", "Error parsing data " + e.toString());
    }

    // return JSON String
    return jObj;

}

Answer 1

$result = mysql_query("SELECT * FROM businessdata WHERE '"
    . mysql_real_escape_string($_REQUEST['varQuery2'])."' =  '" 
    . mysql_real_escape_string($_REQUEST['varQuery1'])."'") 
    or die(mysql_error());

use *_real_escape_string for dealing with sql injection.