I have the following mysql query---
$query="SELECT * FROM `wall_posts`
WHERE
`login_name` = '" . $_SESSION['SESS_LOGIN'] . "'
OR
`login_name` IN (
SELECT friend_login
FROM friends
)
ORDER BY time DESC";
But when I execute it, it does'nt give me expected results also only one post is being displayed!
$_SESSION['SESS_LOGIN']) into queries is dangerous. It may be safe in this instance, but in others you could be opening your site to SQL injection, which is a very serious security risk. To prevent this, always use parameters in prepared statements for values. Note that only simple values can be parameterized. Table names, column names, compound values and the like still need to be (carefully) interpolated.