PHP Using a string inside string

Question

I want to change the 401 in the code below to a string based on a value from my website like

$sql2 = 'SELECT post_content2 FROM wp_posts WHERE ID = '$jeff''

but I'm getting

Parse error: syntax error, unexpected '$jeff' (T_VARIABLE) in /public_html/wp-content/themes/real-spaces/single-property.php on line 384

Here's the code that works:

if(! $conn2 )
{
  die('Could not connect: ' . mysql_error());
}
 $sql2 = 'SELECT post_content2 FROM wp_posts WHERE ID = 401' ;
mysql_select_db('fncletvn_wp389');
$retval2 = mysql_query( $sql2, $conn2 );

if(! $retval2 )
{
  die('Could not get data: ' . mysql_error());
}

while($row2 = mysql_fetch_array($retval2, MYSQL_ASSOC))
{
  echo "{$row2['post_content2']}  <br> " ;

}

I'm very new to programming so plase help :D By the way, what I'm trying to do is pull out the value of post_content2 from the database based on the ID of the current post which is $jeff

`WHERE ID = " ' . $jeff' . ' " '` – Sougata Bose Nov 30 '15 at 04:49 — Sougata Bose, Nov 30 '15 at 04:49

Thamilhan · Accepted Answer · 2015-11-30T04:56:55.790

Simply use quotes like this:

$sql2 = "SELECT post_content2 FROM wp_posts WHERE ID = '$jeff'";

This will create sql string as:

SELECT post_content2 FROM wp_posts WHERE ID = '401'

When $jeff=401

But as per your question, if you want like this:

SELECT post_content2 FROM wp_posts WHERE ID = 401

Just use:

$sql2 = "SELECT post_content2 FROM wp_posts WHERE ID = $jeff";

FYI: Single quotes will not replace your PHP variable with value, instead it prints the variable as it is. Double quotes will do the replacement.

score 1 · Answer 2 · answered Nov 30 '15 at 05:30

1

Either you can use the answer given by @myway or you can use mysql pre pared statements. I will recommend you to use pre-pared statements since they are secure and re usable.

answered Nov 30 '15 at 05:30

Salman Ghauri

574
1
5
16

score 0 · Answer 3 · answered Nov 30 '15 at 05:26

Note that if you use $sql2 = "SELECT post_content2 FROM wp_posts WHERE ID = $jeff";$sql2 = "SELECT post_content2 FROM wp_posts WHERE ID = $jeff"; as indicated by previous commenter, your $jeff must be quoted.

Just be sure to first apply mysql_escape_string($jeff) beforehand.

Also, I now that you did not ask about this, but I absolutely have to warn you that the mysql_* functions are depreciated and you should never use them except when modifying existing code--in which case you should be actively changing your code to the mysqli_* variants.

score 0 · Answer 4 · answered Nov 30 '15 at 05:41

You're also missing the concatenation operator in your code: $sql2 = 'SELECT post_content2 FROM wp_posts WHERE ID = '$jeff''

PHP's concatenation operator is ..

Use it like this: $sql2 = 'SELECT post_content2 FROM wp_posts WHERE ID = '.$jeff;

If $jeff is a string, not an int, you will need to encose it in quotes like this: $sql2 = 'SELECT post_content2 FROM wp_posts WHERE ID = "'.$jeff.'"';

However if $jeff is supplied by the client in any way, you should use prepared statements to protect against mysql injection.

What PHP was trying to tell you with Parse error: syntax error, unexpected '$jeff' (T_VARIABLE), is that it didn't know why there was a variable next to a string in an assignment operation. Nor what you were trying to do with it. The concatenation operator indicates that you want that variable joined to the string next to it as if it were also a string. Which becomes an important distinction in loosely typed languages like PHP.

PHP Using a string inside string

4 Answers4