0

Don't close It , the similar question does not have a good answer ? Not Working Query:

$UT = '36daaae649c8b5bcfffe14e7cf5702cb' ;
$sql = " INSERT INTO foldertable (folderid, `serverToken`) 
    SELECT
        $folderId,
        (SELECT serverToken FROM `servertoken` WHERE `userToken` = $UT LIMIT 1)
    WHERE NOT EXISTS  
        (SELECT folderid FROM foldertable WHERE folderid = $folderId)";

Error Message

Unknown column '36daaae649c8b5bcfffe14e7cf5702cb' in 'where clause'

So I changed it this:

$UT = '36daaae649c8b5bcfffe14e7cf5702cb' ;
$sql = " INSERT INTO foldertable (folderid, `serverToken`) 
    SELECT
        $folderId,
        (SELECT serverToken FROM `servertoken` WHERE `userToken` = '36daaae649c8b5bcfffe14e7cf5702cb'LIMIT 1)
    WHERE NOT EXISTS
        (SELECT folderid FROM foldertable WHERE folderid = $folderId)";

Now Walla !! The query worked . And my mind is like what's the difference between 2 statement.
I googled every thing and changed the query into this:

$sql = " INSERT INTO foldertable (folderid, `serverToken`) 
    SELECT
        $folderId,
        (SELECT serverToken FROM `servertoken` WHERE `userToken` = '$UT' LIMIT 1)
    WHERE NOT EXISTS  
        (SELECT folderid FROM foldertable WHERE folderid = $folderId)";

So Now its working .

So I thought there is a problem of ''. (Although I don't know what the problem with that).

But My eye just caught there is another Variable $folderId there which is

$folderId = "12345" ;

So what's happening here ?

S B RAKESH RATH
  • 443
  • 3
  • 10
  • 3
    I believe in your db, folderid is a numeric field and userToken is storing string. – Ken Lee May 09 '21 at 05:03
  • Ya , So what about it – S B RAKESH RATH May 09 '21 at 05:11
  • 2
    Non numeric strings needs to be quoted: `= '$UT'`, not `= $UT`. Numeric values don't. However, you should rather use prepared statements with bound parameters than manually injecting variables directly into your query like that, or you can open yourself up for SQL injection attacks. It's not only about security though, if the value contains some specific characters, for example a `'`, the query will break as well. – M. Eriksson May 09 '21 at 05:57

0 Answers0