Weird output of mysql union -

<?php $query120 = "(select username friendship frenusername='{$username2}') union (select frenusername friendship username='{$username2}')"; $result120 = mysql_query($query120,$connection) or die (mysql_error()); confirm_query($result120);  while($userinfo120 = mysql_fetch_array($result120)){     $frenusername2= $userinfo120['username'];     echo $frenusername2; } ?> 

the output show result of both select queries. why $frenusername2 has value of $userinfo120['username']; , $userinfo120['frenusername']; both?

ok... i'll bite, need more site can give you. perhaps book or 3 on sql, mysql, , php...

to question: sql union isn't doing think it's doing. when send select sql query database, returns 0 or more rows data requested. each row have number of columns specified in select clause of statement (between select , from).

in query, have 1 column, username. when use union, (possibly) add more rows second query, column names don't change, so, assuming data in friendship looks this:

username | frenusername ---------|------------- usera    | userb usera    | userc userb    | userc userc    | usera 

and $username2 = 'userb', you'll 2 rows this:

username -------- usera userc 

the first row being result from

select username friendship frenusername='{$username2}' 

and second row being result from

select frenusername friendship username='{$username2}' 

if $username2 = 'usera', might expecting result like:

username -------- userc userb userc 

but union removes duplicates result set, giving

username -------- userc userb 

see mysql documentation much, more. in short, though, union not way go when want 2 separate data sets (one set of people have $username2 friend, , 1 set of people $username2 have friend).

as bonus, unless you're including php pages inside other php pages (using include(), etc), don't need worry using same variable name because page being accessed same ajax script.

and yes, should worried sql injection if use data directly post or http request. (i.e., if $username2 assigned value in $_post or $_get , don't test before code provide in question)