query in mysql select with string variable

Question

Error Output

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '//some values

I have a query like this:

$sql = "SELECT col1, col2 FROM table1
WHERE col1 = " . $row['value'] . "";

But if did my query hard code like this:

$sql = "SELECT col1, col2 FROM table1
WHERE col1 = 'string data (string data too)'";

it works as I expected.

Note that I have some values that has ( ) open and close parenthesis like I put in hard coded query above.

Also Note that $row['value'] returns correct value like I tested in the hardcoded query.

I am expecting the same output as in hardcoded query.

score 1 · Accepted Answer · answered Dec 11 '17 at 03:18

1

If this query has a string data then it must be enclosed by quotes ' like as follow.check this query once.

$sql = "SELECT col1, col2 FROM table1
WHERE col1 = '" . $row['value'] . "'";

answered Dec 11 '17 at 03:18

A.D.

2,352
2
15
25

1

But it would be better to used prepared statements, no? – Jay Blanchard Dec 11 '17 at 03:18
@JayBlanchard yes bro but there he has an error I try to solve the error there.I also aware of the thing gone used for security. – A.D. Dec 11 '17 at 03:19
1

A.) not your bro and 2.) we should not be teaching dangerous methods of coding. – Jay Blanchard Dec 11 '17 at 03:20
hmm, i 'll keep that in practice. – A.D. Dec 11 '17 at 03:21
@addy, thanks it works. – Emjey23 Dec 11 '17 at 03:35
@JayBlanchard, thanks for the great suggestion about prepared statements. I will explore it. – Emjey23 Dec 11 '17 at 03:36

query in mysql select with string variable

1 Answers1