Using external parameter in Mysql Database query in PHP

Question

I want to use variable value in a query but for something not often happens like that:

$sql ="select a from x where b ='".$_SESSION["b"]."' Limit '".$_GET["l"]."',1;";

How to set the input of limit properly because it seems to me not working unless there is = before the input.

Answer 1

Your current query will generate

Limit '5',1

Which is invalid SQL, it has to generate

Limit 5,1

Go Figure. And Oh How can I prevent SQL injection in PHP?

Answer 2

Remove '' from the sentence, Limit ".$_GET["l"].",1;" The use of limit in MySQL is this way.

Answer 3

$sessionvar = $_SESSION['b'];
$limit = $_GET['1'];

$sql ="select a from x where b = $sessionvar Limit $limit ,1";