SELECT query inside PHP class

Question

I am trying to run a simple SELECT query inside of a PHP class, using the GET variable.

$this->Token = $_GET['Token'] ?? null;

function getRows(){   
        $query = $this->db->query("SELECT * FROM store_product_images WHERE token = ".$this->Token." ORDER BY display_order ASC");

When I run this, nothing shows, if I remove the WHERE it works fine

Your code is vulnerable to [**SQL injection**](https://en.wikipedia.org/wiki/SQL_injection) attacks. Instead of building queries with string concatenation, always use [**prepared statements**](https://secure.php.net/manual/en/pdo.prepare.php) with [**bound parameters**](https://secure.php.net/manual/en/pdostatement.bindparam.php). See [**this page**](https://phptherightway.com/#databases) and [**this post**](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) for some good examples. — Alex Howansky, Apr 18 '21 at 16:31
If `token` is a string, you would need quotes round the value,but using prepared statements solves this and a few other problems. — Nigel Ren, Apr 18 '21 at 16:32
@NigelRen It does have quotes around it? Could you show me an example of what you mean? — Designer, Apr 18 '21 at 16:32
You missed the quote to indicate that you passed a string on your query. You better write it like this `[...] WHERE token = '{$this->Token}' ORDER BY [...]`. Anyway, you should really consider to escape your value, or better to use prepared statement, as another has mentioned, your code is vulnerable to SQL injection. — Ammar Faizi, Apr 18 '21 at 16:38

score 1 · Accepted Answer · answered Apr 18 '21 at 17:55

1

you missed the quote

$query = $this->db->query("SELECT * FROM store_product_images WHERE `token`= '".$this->Token."' ORDER BY display_order ASC");

answered Apr 18 '21 at 17:55

ha3an

72
2
15

SELECT query inside PHP class

1 Answers1