mysqli select query error 1064

Question

trying to make a query:

$word = $mysqli->real_escape_string($words[$value]);
$valor = $mysqli->real_escape_string($value);

$query = $mysqli->query("SELECT 'w_id' FROM '$valor' WHERE word='$word'");

But the result is :

Error (1064) You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''eng' WHERE word='msms'' at line 1

here eng is a value of $valor

I tried allready a lot of possibilities to insert the variable, and changed names of tables, but nothing helps

tried '".$valor."' as well

Do not quote column and table names, lest they be treated as string literals.. See http://stackoverflow.com/questions/11321491/when-to-use-single-quotes-double-quotes-and-backticks — Michael Berkowski, Dec 13 '13 at 17:04
I advise you _not_ to use an input value in `$valor` as a table name there anyway, since `real_escape_string()` cannot correctly protect that against SQL injection. Instead, if you need to dynamically supply a table name you should check the value against an array of acceptable possible values. — Michael Berkowski, Dec 13 '13 at 17:06

score 1 · Answer 1 · answered Dec 13 '13 at 17:06

1

Do not put quotation marks around the table/field names:

$query = $mysqli->query("SELECT w_id FROM " . $valor . " WHERE word = '" . $word . "'");

answered Dec 13 '13 at 17:06

Joshua Smickus

1,011
10
14

@YourCommonSense yes it is. – Joshua Smickus Dec 13 '13 at 17:13
You should take back your `-1` and I quote you: *"Unfortunately, this site is not about fixing your code."* as per [your comment here](http://stackoverflow.com/questions/20572191/pdo-if-fetch-then-print-rsmt-fetchpdofetch-obj-wont-show-any-result#comment30771717_20572191) Josh merely outlined where the error was. @YourCommonSense – Funk Forty Niner Dec 13 '13 at 17:24
1

Haha! I can't believe I got -1'ed - @YourCommonSense would you rather I re-wrote his whole DB integration as well? I'm not in the business of fixing someone's bad practice, merely pointing out how to get it going. – Joshua Smickus Dec 13 '13 at 17:39
@Fred-ii- the error was merely outlined in the *comments*. While he offered a *solution*. A wrong one. Nobody asked him to, but as he volunteered and failed, he got deserved -1. – Your Common Sense Dec 13 '13 at 17:45
3

Then (theoretically), the OP should also get `-1` if you're going to start doing that. @YourCommonSense – Funk Forty Niner Dec 13 '13 at 17:46

mysqli select query error 1064

1 Answers1