Php variables in for selecting in my mysql query

Question

I try to make a selection in SQL using php variables. The code is like this:

$st=$_POST["st"] ;
$tu=$_POST["tu"] ; 
$data=$_POST["data"];
$ec= $_POST["ec"] ;

$sql="SELECT nr, '.$ec.' FROM 'report' WHERE st='.$st.' and tu='.$tu.' and dataupdate='.$data.'";

but I get 0 results.

If I change variables from the SQL query with values, it works. Also I test with

echo $st ; 
echo $tu ; 
echo $data ; 
echo $ec ;

and it returns correct value of post. Can anybody tell me what I do wrong ?

your sql is wrong. you can `echo` the `$sql` and try it on phpmyadmin to check weather its correct. — Athi Krishnan, Oct 27 '15 at 09:54
this error happened because you don't around your string variables with quotes. P.S. you can also use sprintf to avoid sql-injection. Or, better, use PDO — Sergio Ivanuzzo, Oct 27 '15 at 09:58

CodeLove · Answer 1 · 2015-10-27T10:04:14.843

1

Your right query

$sql="SELECT nr, '".$ec."' FROM 'report' WHERE st='".mysql_escape_string($st)."' and tu='".mysql_escape_string($tu)."' and dataupdate='".mysql_escape_string($data)."'";

edited Oct 27 '15 at 10:04

answered Oct 27 '15 at 09:54

CodeLove

462
4
14

I feel the Dark Side of the Force! I feel sql-injection here – Sergio Ivanuzzo Oct 27 '15 at 10:01

score 1 · Answer 2 · edited May 23 '17 at 12:15

1

First, you're mixing string concatenation using . with replacing variable names directly inside a string quoted using ". You need to choose one of the approaches:

"SELECT '$ec' ..."
"SELECT '" . $ec . "' ..."

Second, your way to build the SQL query is very dangerous as it allows SQL Injection attack. Use parameterized queries instead: parameters in MySQLi

edited May 23 '17 at 12:15

Community

1
1

answered Oct 27 '15 at 09:57

Jiri Tousek

12,211
5
29
43

score 0 · Answer 3 · edited Oct 27 '15 at 10:56

0

Try this:

$st   = $_POST["st"];
$tu   = $_POST["tu"]; 
$data = $_POST["data"];
$ec   = $_POST["ec"];

$sql = "SELECT nr, $ec FROM `report` WHERE st='$st' and tu='$tu' and dataupdate='$data'";

edited Oct 27 '15 at 10:56

Jazi

6,569
13
60
92

answered Oct 27 '15 at 09:53

sandeepsure

1,113
1
10
17

what about some sql-injection in your query? – Sergio Ivanuzzo Oct 27 '15 at 10:00
@SergioIvanuzzo you can use `mysql_real_escape_string()` to overcome this. – sandeepsure Oct 27 '15 at 10:01
I can, but instead I will use sprintf or PDO and prepare method :D – Sergio Ivanuzzo Oct 27 '15 at 10:03

Php variables in for selecting in my mysql query

3 Answers3