URL encoded variable in SQL query?

[thenetbox]

does any one here know how to inject an SQL query with a URL encoded variable?

I have been trying this but it gives an error

$result = mysql_query("SELECT image_name FROM photo_album WHERE file_name='$username' ",$db);
if (!$result) {
echo("Sorry no Pictures: " . mysql_error(). "</p>");


I type http://www.url.com/memberpics.php?username=vivica

but it gives an error

Is there some other way to get it to work with an SQL query like that? like a different command? help :(

[Neo]

If you are using VB for it try this


if (!$DB_site->query("SELECT image_name FROM photo_album WHERE file_name='$username'")) {
echo ("Sorry no pictures: . mysql_error(). "</p>");