"unexpected T_VARIABLE" when creating string?

Question

I have been staring at this for 20 minutes now and I can't figure out what I'm doing wrong.

// Create query
$qry = "SELECT * FROM members WHERE member_id='"$_SESSION['SESS_MEMBER_ID']"'";
$result = mysql_query($qry);

Parse error: syntax error, unexpected T_VARIABLE in /home/dkitterm/public_html/test2/member-profile.php on line 24

If only you were using placeholders ... you would have 1) avoided this error entirely, 2) have cleaner looking code, 3) stopped potential injection attacks. See http://stackoverflow.com/questions/60174/best-way-to-stop-sql-injection-in-php — , Dec 15 '11 at 00:12
Dup: http://stackoverflow.com/questions/3401319/php-mysql-help-unexpected-t-variable — , Dec 15 '11 at 00:18
Related: http://stackoverflow.com/questions/7709824/mail-form-in-php-syntax-error-unexpected-t-variable — , Dec 15 '11 at 00:19

score 5 · Accepted Answer · answered Dec 15 '11 at 00:08

5

You need to concatenate the string literals with the variable with the . operator:

$qry = "SELECT * FROM members WHERE member_id='" . $_SESSION['SESS_MEMBER_ID'] . "'";

answered Dec 15 '11 at 00:08

score 1 · Answer 2 · answered Dec 15 '11 at 00:08

1

You need to concatenate your string:

$qry = "SELECT * FROM members WHERE member_id='" . $_SESSION['SESS_MEMBER_ID'] . "'";

answered Dec 15 '11 at 00:08

cmbuckley

score 1 · Answer 3 · answered Dec 15 '11 at 00:14

The less cumbersome approach is using string interpolation. You're already in a double quoted string, so why not utilize its one distinct feature?

$qry="SELECT * FROM members WHERE member_id='{$_SESSION['SESS_MEMBER_ID']}'";

That's terser and less room for syntax errors.
See also http://php.net/manual/en/language.types.string.php#language.types.string.syntax.double (There's a shorter syntax even, if you read on.)

score 0 · Answer 4 · answered Dec 15 '11 at 00:09

0

Change it to:

 //Create query
 $qry="SELECT * FROM members WHERE member_id='" . $_SESSION['SESS_MEMBER_ID'] . "'";
 $result=mysql_query($qry);

You forgot the concatenation operator, .

answered Dec 15 '11 at 00:09

Cyclone

score 0 · Answer 5 · answered Dec 15 '11 at 00:09

0

$qry="SELECT * FROM members WHERE member_id='" . $_SESSION['SESS_MEMBER_ID'] . "'";

You must concentrate your strings with . operator

answered Dec 15 '11 at 00:09

robert petranovic

5 Answers5