0

I was wondering if after all these hours of trying you could help me

After hours of trying i still have a problem retrieving data from a mysql query: This is my query:

$res =mysql_query("SELECT * FROM user WHERE username =".$_SESSION['user']);

The user in the session is the current username.

i have an if statement like this:

if(!$res)
{
    die('Invalid query: ' . mysql_error());
}

i run the code to check if the mysql_error isn't thrown but everytime i get this error:

Invalid query: Unknown column 'Amando' in 'where clause'

Can someone explain to me what im doing wrong and maybe help me fix it

Shujaat
  • 691
  • 4
  • 18
Amando Vledder
  • 1,316
  • 1
  • 13
  • 23

2 Answers2

1

You need to enclose the $_SESSION['user'] in quotes for MYSQL to consider it a string rather than a column name

$res =mysql_query('SELECT * FROM user WHERE username ="'.$_SESSION['user'].'"');
Shujaat
  • 691
  • 4
  • 18
0

You need to quote the user variable. Try this

$res =mysql_query("SELECT * FROM user WHERE username ='".$_SESSION['user']."'");

You should also read up on SQL injection and maybe PDO since your code is vulnerable for SQL injections as it is now. Or at least it can be, depending on if you have secured/validated the session variable before you use it in the query.

Andy
  • 397
  • 2
  • 8