-2

I am using the following code to check if an email address exists in a database I am getting the email value from an HTML form. I could verify the SQL query being executed and that part is working. My guess is, that I can not use the $result as I am doing it. I always get a "not found".

$command = ("SELECT * FROM '$table_name'" ." WHERE email = '$email'");
$result = $db->query($command);


if (!$result )

{
echo "not found";
} 

else {
echo "found";
}
d_wesseling
  • 141
  • 1
  • 11

1 Answers1

1

Table name doesn't need quote.

$command = "SELECT * FROM $table_name WHERE email = '$email'";

Then sql injection problem is another problem.

xdazz
  • 158,678
  • 38
  • 247
  • 274