Select - correct concatenation PHP

Question

Not sure how to do the concatentation within php; username and password are strings

    $query = "SELECT id, username";
    $query .= "FROM users ";
    $query .= "WHERE username = '{$username}'";
    $query .= "AND hashed_password = '{$hashed_password}'";
    $query .= "LIMIT 1";

I also tried this:

    $query .= "WHERE username =" . $username;
    $query .= "AND hashed_password =" . $hashed_password

Where exactly am I failing..? Might be a stupid question... but I'm a php newb.

Put spaces in between! You query is at the moment: `"SELECT id, usernameFROM users WHERE username = '{$username}'AND hashed_password = '{$hashed_password}'LIMIT1` And I don't think you have a table called: `usernameFROM` — Rizier123, May 03 '15 at 19:51

score 1 · Accepted Answer · edited May 23 '17 at 12:17

You're on the right track but as the comments say, remember to think about the spaces when concatenating:

$query = "SELECT id, username ";
$query .= "FROM users ";
$query .= "WHERE username = '$username' ";
$query .= "AND hashed_password = '$hashed_password' ";
$query .= "LIMIT 1";

That said, you should also look into preventing SQL injection. See this SO question: How can I prevent SQL injection in PHP?

score 0 · Answer 2 · answered May 03 '15 at 20:18

Description:-As per your code query result is like this:-

SELECT id, usernameFROM users WHERE username = 'admin'AND hashed_password = '48949fufu488494'LIMIT 1

SO here what happen you need to give space so after your $query end otherwise its going to concatenate and it changes your $query(username from users whereas according to your query it is usernameFROM users). Below is code .To just show you the right way,i just assign variable for $username and $password default.Hope it helps you.Let me know if it works or not.Below is Code:-

<?php

$username = "admin";
$hashed_password = "48949fufu488494";
    $query = "SELECT id , username ";
    $query .= "FROM users ";
    $query .= "WHERE username = '{$username}' ";
    $query .= "AND hashed_password = '{$hashed_password}' ";
    $query .= "LIMIT 1";

    echo $query;
?>

If you write your code like this than php is going to read like this.Which is the right way:- SELECT id , username FROM users WHERE username = 'admin' AND hashed_password = '48949fufu488494' LIMIT 1

Select - correct concatenation PHP

2 Answers2