SQL Json Query With Variable

Question

I am trying to query SQL database with IMEI variable from android device, the variable is received (verified with log.txt), however whenever I replace '00000000000000' (android virtual device IMEI) with '$androidIMEI' the results are not returned but if I explicitly use the IMEI and not the variable I receive data.

<?php

include 'config.php';

$con=mysql_connect("$servername", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$dbname")or die("cannot select DB");

$androidIMEI = isset($_POST['IMEI']) ? $_POST['IMEI'] : '';

//$f = fopen("log.txt", "w");
//fwrite($f, print_r($androidIMEI, true));
//fclose($f); 

$sql = "SELECT * from users WHERE Request = '0' AND IMEI = '000000000000000' ";
//$sql = "SELECT * from users WHERE Request = '0' AND IMEI = '$androidIMEI ' "; //not working
$result = mysql_query($sql);
$json = array();

if(mysql_num_rows($result)){
    while($row=mysql_fetch_assoc($result)){
    $json['users'][]=$row;
    }
}
mysql_close($con);
echo json_encode($json); 
?>

Update: (printing SQL to log file)

$sql = "SELECT * from users WHERE Request = '0' AND IMEI = '$androidIMEI'";
$result = mysql_query($sql);

$f = fopen("log.txt", "w");
fwrite($f, print_r($sql, true));
fclose($f);

Reading Log File:

SELECT * from users WHERE Request = '0' AND IMEI = '000000000000000'

AND THIS IS WHY I HAVE NO IDEA WHY IT IS NOT WORKING

Second Update:

This might be useful, code from android, how I'm sending my IMEI to PHP:

    class loadData extends AsyncTask<String, Integer, String> {
            private StringBuilder sb;
            private ProgressDialog pr;
            private HttpResponse req;
            private InputStream is;

            @Override
            protected void onPreExecute() {
                super.onPreExecute();

            }

            @SuppressWarnings("deprecation")
            @Override
            protected String doInBackground(String... arg0) {

                  ArrayList<NameValuePair> nameValuePairs = new ArrayList<NameValuePair>();         

                nameValuePairs.add(new BasicNameValuePair("IMEI",IMEI));

                System.out.println("IMEI: "+IMEI);


                    try
                    {
                    HttpClient httpclient = new DefaultHttpClient();
                    HttpPost httppost = new HttpPost("http://mysite/myfile.php");
                    httppost.setEntity(new UrlEncodedFormEntity(nameValuePairs));
                    HttpResponse response = httpclient.execute(httppost); 
                    HttpEntity entity = response.getEntity();
                    is = entity.getContent();
                    InputStreamReader ireader = new InputStreamReader(is);
                    BufferedReader bf = new BufferedReader(ireader);
                    sb = new StringBuilder();
                    String line = null;
                    while ((line = bf.readLine()) != null) {
                        sb.append(line);
                    }
                    Log.e("pass 1", "connection success ");


                }
                    catch(Exception e)

                {

                    System.out.println("Error catch e");


                }
                    return id;     

            }

Do you see the value of `$_POST['IMEI']` when you `echo $sql;` using `$androidIMEI`? — user2959229, Nov 25 '15 at 13:40
I tried that and to my surprise I get: SELECT * from users WHERE Request = '0' AND IMEI = '000000000000000' which seems to be fine however it still doesn't work with: SELECT * from users WHERE Request = '0' AND IMEI = '$androidIMEI' — user3560827, Nov 25 '15 at 13:47
check the source (form) of the `$_POST['IMEI']` variable and make sure that it is sending the correct value. — user2959229, Nov 26 '15 at 05:30

score 0 · Answer 1 · edited May 23 '17 at 12:15

0

Change "SELECT * from users WHERE Request = '0' AND IMEI = '$androidIMEI ' " with "SELECT * from users WHERE Request = '0' AND IMEI = '".$androidIMEI."' ".

Also you are vulnerable for SQL injections. Do not use deprecated mysql_* functions and filter your input. More information at How can I prevent SQL injection in PHP?

edited May 23 '17 at 12:15

Community

1
1

answered Nov 25 '15 at 13:45

Mantas

4,259
2
27
32

score 0 · Answer 2 · answered Nov 25 '15 at 13:47

0

There is a space after $androidIMEI in your query.

$sql = "SELECT * from users WHERE Request = '0' AND IMEI = '$androidIMEI ' ";

should be

$sql = "SELECT * from users WHERE Request = '0' AND IMEI = '$androidIMEI';";

answered Nov 25 '15 at 13:47

user2959229

1,360
2
11
21

the space was not the problem even after removing space – user3560827 Nov 25 '15 at 14:05

score 0 · Answer 3 · answered Nov 26 '15 at 13:05

0

Try this line

$sql = "SELECT * from users WHERE Request = '0' AND IMEI = '{$android}IMEI'";

I hope it will work.

Just note those curly braces.

answered Nov 26 '15 at 13:05

pgp

89
3

SQL Json Query With Variable

3 Answers3