php - Error in SQL syntax, check the manual that corresponds to your MySQL server version for the right syntax to use near 'ORDER BY category ASC' at line 1 -

site has been working fine years , of sudden getting error. experts appreciated.

you have error in sql syntax; check manual corresponds mysql server version right syntax use near 'order category asc' @ line 1

here code in question:

// sql injection attack prevention function $unit_recordset1 = ""; if (isset($_get['unit'])) {   $unit_recordset1 = getsqlvaluestring($_get['unit'], "text"); } $category_recordset1 = ""; if (isset($_get['category'])) {   $category_recordset1 = getsqlvaluestring($_get['category'], "text"); } else $_get['category'] = "";  // query builder create single or multiple , query $sql = "select * documents "; if(!empty($unit_recordset1)) {$sql .= " unit = $unit_recordset1 , ";} if(!empty($category_recordset1)) {$sql .= " category = $category_recordset1 , ";} // remove last , $sql = substr($sql, 0, -4); if(!empty($category_recordset1)) $sql .= " order title asc"; else $sql .= " order category, title asc";   // query left nav distinct category values $sqlnav = "select distinct category documents unit = $unit_recordset1 order category asc";   mysql_select_db($database_local, $local);  $recordset1 = mysql_query($sql, $local) or die(mysql_error()); $row_recordset1 = mysql_fetch_assoc($recordset1); $totalrows_recordset1 = mysql_num_rows($recordset1);  $recordset2 = mysql_query($sqlnav, $local) or die(mysql_error()); $row_recordset2 = mysql_fetch_assoc($recordset2); $totalrows_recordset2 = mysql_num_rows($recordset2); 

there flows $unit_recordset1 may empty. in case, following statement:

$sqlnav = "select distinct category documents unit = $unit_recordset1 order category asc"; 

will evaluate to:

select distinct category documents unit = order category asc 

which, of course, isn't valid sql. need add check against case too, down lines of:

$unitclause = ""; if(!empty($unit_recordset1) {     $unitclause = "where unit = $unit_recordset1 "; } $sqlnav = "select distinct category documents $unitclause order category asc";