return multiple rows from sql statement

[giloosh]

i would like to filter out a bunch rows from a table of sql row
results.
i have a checkbox on each row named checkbox[x]
(x = the current row id)
i will submit the form and take all the rows that are checked and
filter out the ones that are not checked.

so if i had 10 rows and i checked 3 of them then when i submit the
form only those 3 rows will show up.

I was wondering what was the best way to call those rows in the sql
statement.

Would i just loop through the rows that were checked and add them to
the WHERE STATEMENT using the OR condition?

select * from rows where id = 3 or id = 2 or id = 6 or id = 10

so basically i would do something like this with the php code.
$sql = "select * from rows WHERE 1 ";
foreach ($_POST[checkbox] as $check){
$sql .= " OR id = $check";
}

I just think its slow to use so many OR conditions in one sql
statement, but i cant think of anyway else to do this.
Is the way i want to do this a good way?
Thanks for your help

[Jan =?UTF-8?B?VGhvbcOk?=]

giloosh wrote:

Would i just loop through the rows that were checked and add them to
the WHERE STATEMENT using the OR condition?

select * from rows where id = 3 or id = 2 or id = 6 or id = 10

You could try the IN variant like:

select * from rows where id in ( ?, ?, ?, ?);

This might be a bit faster than the ORs...

Best regards,
Jan

--
_______________ _______________ _______________ _______________ _____________
insOMnia - We never sleep...
http://www.insOMnia-hq.de

[giloosh]

On Aug 29, 12:20 pm, Jan Thomä <k...@insomni a-hq.dewrote:

giloosh wrote:

Would i just loop through the rows that were checked and add them to

Thanks Jan.
I will do a few SQL tests to see which method is faster.

the WHERE STATEMENT using the OR condition?

select * from rows where id = 3 or id = 2 or id = 6 or id = 10

You could try the IN variant like:

select * from rows where id in ( ?, ?, ?, ?);

This might be a bit faster than the ORs...

Best regards,
Jan

--
_______________ _______________ _______________ _______________ _____________
insOMnia - We never sleep...http://www.insOMnia-hq.de

[Good Man]

giloosh <gi*******@gmai l.comwrote in news:1188403377 .477061.290770
@o80g2000hse.go oglegroups.com:

Would i just loop through the rows that were checked and add them to
the WHERE STATEMENT using the OR condition?

select * from rows where id = 3 or id = 2 or id = 6 or id = 10

so basically i would do something like this with the php code.
$sql = "select * from rows WHERE 1 ";
foreach ($_POST[checkbox] as $check){
$sql .= " OR id = $check";
}

i'll assume this code is here for brevity, and that you're really making
sure that your $check variable contains what you're expecting it to (a
number).

I tend to craft my SQL 'where' statements AFTER checking for variables,
assembling them as a string, and appending them to a query.

ie:
$whereVar = "1";
foreach($_POST['checkbox'] as $check) {
if(is_numeric($ check)) {
$whereVar .= " OR id='$check'";
}
}

$sql = "SELECT * FROM rows WHERE $whereVar";

ps: naming a MySQL table "rows" can certainly lead to confusion down the
road... try to stay away from reserved words and their permutations
entirely

I just think its slow to use so many OR conditions in one sql
statement, but i cant think of anyway else to do this.

As long as "id" is properly indexed, it won't be slow. You're searching
for results based on conditions... there's no way to avoid searching!

[Jerry Stuckle]

giloosh wrote:

On Aug 29, 12:20 pm, Jan Thomä <k...@insomni a-hq.dewrote:

>giloosh wrote:

>>Would i just loop through the rows that were checked and add them to

Thanks Jan.
I will do a few SQL tests to see which method is faster.

>>the WHERE STATEMENT using the OR condition?
select * from rows where id = 3 or id = 2 or id = 6 or id = 10

You could try the IN variant like:

select * from rows where id in ( ?, ?, ?, ?);

This might be a bit faster than the ORs...

Best regards,
Jan

--
______________ _______________ _______________ _______________ ______________
insOMnia - We never sleep...http://www.insOMnia-hq.de

You could even ask in a SQL group, since this isn't a PHP question.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===

[Jan =?UTF-8?B?VGhvbcOk?=]

Good Man wrote:

>
i'll assume this code is here for brevity, and that you're really making
sure that your $check variable contains what you're expecting it to (a
number).

I tend to craft my SQL 'where' statements AFTER checking for variables,
assembling them as a string, and appending them to a query.

I always use the placeholder notation for doing SQL. Concatening SQL strings
from input values is almost certainly a safe path to SQL injection. So what
i'd do is:

foreach( ... ) {
$where .= "OR id = ?";
}

and then use a framework like AdoDB to have them replace the placeholders.
Saves a lot of time and problems...

Best regards,
Jan
--
_______________ _______________ _______________ _______________ _____________
insOMnia - We never sleep...
http://www.insOMnia-hq.de

[Jerry Stuckle]

Jan Thomä wrote:

Good Man wrote:

>i'll assume this code is here for brevity, and that you're really making
sure that your $check variable contains what you're expecting it to (a
number).

I tend to craft my SQL 'where' statements AFTER checking for variables,
assembling them as a string, and appending them to a query.

I always use the placeholder notation for doing SQL. Concatening SQL strings
from input values is almost certainly a safe path to SQL injection. So what
i'd do is:

foreach( ... ) {
$where .= "OR id = ?";
}

and then use a framework like AdoDB to have them replace the placeholders.
Saves a lot of time and problems...

Best regards,
Jan

Not if you properly cleanse your input. Ensure numeric values are
really numeric, and string values are processed through
mysql_real_esca pe_string(), for instance.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===

[Jan =?UTF-8?B?VGhvbcOk?=]

Jerry Stuckle wrote:

Jan Thomä wrote:

>I always use the placeholder notation for doing SQL. Concatening SQL
strings from input values is almost certainly a safe path to SQL
injection.

Not if you properly cleanse your input. Ensure numeric values are
really numeric, and string values are processed through
mysql_real_esca pe_string(), for instance.

Thanks for the input, and yes I agree, you should definitely cleanse your
input before feeding it to the database. My point was simply, that when you
give this kind of work to a framework and always use the ? notation, you
are safe from injection, even if you forget to check a single input
variable (which surely happens from time to time). Also you don't have to
do the conversions to different formats manually, so you save a bit of time
and effort.

Best regards,
Jan

--
_______________ _______________ _______________ _______________ _____________
insOMnia - We never sleep...
http://www.insOMnia-hq.de

[giloosh]

On Aug 30, 9:11 am, Jan Thomä <k...@insomni a-hq.dewrote:

Jerry Stuckle wrote:

Jan Thomä wrote:

I always use the placeholder notation for doing SQL. Concatening SQL
strings from input values is almost certainly a safe path to SQL
injection.

Not if you properly cleanse your input. Ensure numeric values are
really numeric, and string values are processed through
mysql_real_esca pe_string(), for instance.

Thanks for the input, and yes I agree, you should definitely cleanse your
input before feeding it to the database. My point was simply, that when you
give this kind of work to a framework and always use the ? notation, you
are safe from injection, even if you forget to check a single input
variable (which surely happens from time to time). Also you don't have to
do the conversions to different formats manually, so you save a bit of time
and effort.

Best regards,
Jan

--
_______________ _______________ _______________ _______________ _____________
insOMnia - We never sleep...http://www.insOMnia-hq.de

thanks for the feedback...
isn't is safe to just put quotes around the variable
$id = $_POST['id']

$q = "select * from table1 where id = '$id'";

even if id holds none numeric characters, it's still safe... no?

[ELINTPimp]

On Aug 31, 2:18 pm, giloosh <giloos...@gmai l.comwrote:

On Aug 30, 9:11 am, Jan Thomä <k...@insomni a-hq.dewrote:

Jerry Stuckle wrote:

Jan Thomä wrote:
>I always use the placeholder notation for doing SQL. Concatening SQL
>strings from input values is almost certainly a safe path to SQL
>injection.

Not if you properly cleanse your input. Ensure numeric values are
really numeric, and string values are processed through
mysql_real_esca pe_string(), for instance.

Thanks for the input, and yes I agree, you should definitely cleanse your
input before feeding it to the database. My point was simply, that whenyou
give this kind of work to a framework and always use the ? notation, you
are safe from injection, even if you forget to check a single input
variable (which surely happens from time to time). Also you don't have to
do the conversions to different formats manually, so you save a bit of time
and effort.

Best regards,
Jan

--
_______________ _______________ _______________ _______________ _____________
insOMnia - We never sleep...http://www.insOMnia-hq.de

thanks for the feedback...
isn't is safe to just put quotes around the variable
$id = $_POST['id']

$q = "select * from table1 where id = '$id'";

even if id holds none numeric characters, it's still safe... no?

No. That introduces sql injection and cross site scripting
vulnerabilities . mysql_real_esca pe_strings, as previously suggested,
will help prevent against this.