how can i put a php variable into mysql command

Question

$id1 = $_POST['number']; //here i am getting a php variable called number

$result = mysqli_query($con, "SELECT id,main FROM first WHERE ?how can i put that number right here?");

I am getting a variable from another page using ajax and i should put it into mysql command.How can i do that?

Use prepared statements! Use prepared statements! Use prepared statements! Use prepared statements! Read the manual for examples. This is about as basic as it can get when working with MySQL in PHP, so it should be covered by any random tutorial even. — deceze, Dec 09 '13 at 14:24
[Start with the `mysqli::prepare()` docs](http://php.net/manual/en/mysqli.prepare.php) — Michael Berkowski, Dec 09 '13 at 14:25
@deceze i guess you learn it after ten minutes you were born. i learn it now basically — user2783998, Dec 09 '13 at 14:28
@user Of course I did not, but I also read books and tutorials to learn this and did research when I didn't know. Please research, we are not here to teach bare basics. — deceze, Dec 09 '13 at 14:30
@Shankar +1 to that. Questions like this tend to attract low-quality answers (QED) which spread bad knowledge and do not contribute to the advancement of the art. — deceze, Dec 09 '13 at 14:32
@deceze So this guy is wrong? http://stackoverflow.com/questions/9814642/can-mysql-real-escape-string-alone-prevent-all-kinds-of-sql-injection "Prepared statements is not a silver bullet too. It covers your back for only half of possible cases" or you're just wrong? — Loko, Dec 09 '13 at 14:58
@Loko That "guy" is one of the craziest and at the same time most competent people on here, I'd be very careful to call him anything. However, does it really contradict what I said? What *you* recommend was pure, classic SQL injection which is one of the most widespread security problems on the web. I was at least pointing the OP in the better direction. That I cannot cover all security and best-practices related topics in their entirety in one comment does not invalidate my argument completely, not does it make yours any better. — deceze, Dec 09 '13 at 15:03
@loko That post just states the obvious: That prepared statements **and** placeholders are required to protect from injection. If you use string interpolation in your prepared statements, you're defeating the purpose. — tadman, Dec 09 '13 at 15:58

score 1 · Answer 1 · answered Dec 09 '13 at 14:28

Here's an example of using prepared statements:

   /* Create a new mysqli object with database connection parameters */
   $mysqli = new mysql('localhost', 'username', 'password', 'db');

   if(mysqli_connect_errno()) {
      echo "Connection Failed: " . mysqli_connect_errno();
      exit();
   }

   /* Create a prepared statement */
   if($stmt = $mysqli -> prepare("SELECT priv FROM testUsers WHERE username=?
   AND password=?")) {

      /* Bind parameters
         s - string, b - blob, i - int, etc */
      $stmt -> bind_param("ss", $user, $pass);

      /* Execute it */
      $stmt -> execute();

      /* Bind results */
      $stmt -> bind_result($result);

      /* Fetch the value */
      $stmt -> fetch();

      echo $user . "'s level of priviledges is " . $result;

      /* Close statement */
      $stmt -> close();
   }

   /* Close connection */
   $mysqli -> close();

Source

I strongly suggest researching prepared statements early on.

It's odd advocating `mysqli` when PDO is a more robust interface layer. — tadman, Dec 09 '13 at 15:58
@tadman : **Agreed**. But one step at a time. I think learning about the existence and benefits of things like stored procedures and prepared statements top learning about PDO at this point. `mysqli` works and he won't do any harm with it if he uses it properly. — Rayhan Muktader, Dec 09 '13 at 17:25

score 0 · Answer 2 · answered Dec 09 '13 at 14:25

0

option 1.Good to go for Prepared statements

option 2."SELECT id,main FROM first WHERE id=$id"

When a string is specified in double quotes, variables are parsed within it.

answered Dec 09 '13 at 14:25

Angelin Nadar

8,944
10
43
53

Downvoter, care to explain ? – Shankar Narayana Damodaran Dec 09 '13 at 14:29
_".Good to go for Prepared statements"_ is extremely unhelpful and pretty meaningless. Perhaps you can say what a prepared statement is, where to find info about it, or how to code it. – Michael Berkowski Dec 09 '13 at 14:29
the downvoters are mad that you dont do it their way. +1 – Loko Dec 09 '13 at 14:34

score 0 · Answer 3 · answered Dec 09 '13 at 14:25

0

$result = mysqli_query($con, "SELECT id,main FROM first WHERE your_db_field = $id1");

OR

$result = mysqli_query($con, "SELECT id,main FROM first WHERE your_db_field = " . $id1 . ");

Should work just fine.

However you should consider using Stored Procedures to avoid any security vulnerabilities...

answered Dec 09 '13 at 14:25

seedg

21,692
10
42
59

Don't recommend practices prone to SQL injection. – deceze Dec 09 '13 at 14:27

laxman954 · Answer 4 · 2013-12-09T18:13:01.157

-1

//Get ur name from Post Request    
$number=$_POST['number'];
$query="SLEECT * FROM TABLE_NAME WHERE colunm_name='$number"; (or)
$query="SLEECT * FROM TABLE_NAME WHERE colunm_name='".$number."'";
$result=mysql_query($con,$query)

//Using Prepared Statement
$stmt = $dbh->prepare("SELECT * FROM TABLE_NAME where COLUMN_NAME= ?");
if ($stmt->execute(array($_GET['number']))) {
 while ($row = $stmt->fetch()) {<br />
    print_r($row);<br />
 }

}

edited Dec 09 '13 at 18:13

answered Dec 09 '13 at 14:43

laxman954

133
1
8

1

Come on, some code formatting, please. Click the `{}` button and it'll do it for you. – tadman Dec 09 '13 at 15:59

how can i put a php variable into mysql command

4 Answers4