MySQL Query not working when using $_POST Variable

Question

Possible Duplicate:
How to include a PHP variable inside a MySQL insert statement

i want to select the Category ID of a Wordpress Category by its name. The weird thing is, that if i define the Category manually, it all works perfectly.

The echo command gives me the category Name and at the end i get the Category ID in the Variable $catid.

If however i send it through a form, the echo command gives me the exact same Category Name as it does when defined manually, but the MySQL-Command just doesn't work, meaning the $catid variable stays empty.

Does anybody here have an idea, as i just can't get my head around why it works when defined directly but not when the exact same string is Posted through a form. The Code example below is part of my code with the $category Variable being passed through a form. If i were to uncomment the manual variable and comment the post variable it would all work.

// $category = "Manual"; // manually defined

$category = $_POST['category']; //defined through a form

echo $category;

$connect = mysql_connect(localhost,abc,def); 

if (!$connect) {
    die('Could not connect: '.mysql_error());
}

mysql_select_db("abc");
$queryresult = mysql_query("SELECT * FROM `wp_terms` WHERE `name`='$category' LIMIT 0,1");

while($row = mysql_fetch_array( $queryresult )) {
     $catid = $row[term_id];
}

You can always check `mysql_error()` if something doesn't work. — mario, Jan 06 '13 at 14:59
Also note that the [`mysql_*`](http://php.net/manual/en/function.mysql-query.php) functions are being deprecated. You should not use them for new projects. Use [Mysqli](http://php.net/manual/en/book.mysqli.php) or [PDO](http://php.net/manual/en/class.pdo.php) instead. — Arjan, Jan 06 '13 at 15:00
I also tried defining the variable as a string, but that does not help. — Robin Jo Justus, Jan 06 '13 at 15:37

Dan Belden · Answer 1 · 2013-01-07T09:17:09.923

It's a good idea to confirm the contents of your post data, something like this:

print_r($_POST); die;

That will allow you to see if your variable is even present in the submission, my bet is either you aren't passing it, or it's coming through under another name (Maybe even a typo).

It's difficult to answer this question without the form and the processing code, but you can at-least de-bug your data, by dumping variable contents to screen.

Hope this helps.

PS: This is wasting resources:

echo "$category";

You can use this:

echo $category;

PPS: Best to clean your variables to prevent SQL injection, this code is very dangerous:

$category = $_POST['category'];
mysql_query("SELECT * FROM `wp_terms` WHERE `name`='$category' LIMIT 0 , 1");

If your variable is passing from PPOST correctly, try de-bugging your SQL query like so:

$query = sprintf("SELECT * FROM wp_terms WHERE name='%s' LIMIT 0,1", $category);
print_r($query); die;

Then if you have some interface for your database running, try throwing your query through it and checking for errors and results (Just to confirm your retrieval statement).

If this works fine, then you know it's something to do with your SQL connect statements for sure, and you'll need to find your PHP version and dump out the value of $connect. Are you running this code on a shared hosting environment, or your own private server?

Thanks for the advice so far! When i use the print_r i can see that the post ist working correctly however! — Robin Jo Justus, Jan 06 '13 at 15:30
any other Ideas, @danbelden ? It's weird that i don't get an error from mysql and the variable is available for the echo command but not for the mysql one. — Robin Jo Justus, Jan 06 '13 at 15:49

MySQL Query not working when using $_POST Variable

1 Answers1