Mysql fetch PHP variable

Question

$sql = "SELECT email FROM family WHERE family = '$family'";
                $result = mysql_query($sqll)or die(mysql_error());

Is this the right way to get php variable into mysql query?

score 1 · Accepted Answer · answered Jan 11 '12 at 05:04

1

That could work. However, it's vulnerable to SQL injection.

This is safer:

$sql = sprintf("SELECT email FROM family WHERE family = '%s'",
               mysql_real_escape_string($family));
$result = mysql_query($sql);

answered Jan 11 '12 at 05:04

Sergio Tulentsev

226,338
43
373
367

score 1 · Answer 2 · answered Jan 11 '12 at 05:19

1

If you starting with PHP/MySQL I would recommend you to check PDO or MySQLi extension as it allows you to use more smart database queries and easier to maintain.

answered Jan 11 '12 at 05:19

Nazariy

6,028
5
37
61

score 0 · Answer 3 · answered Jan 11 '12 at 05:17

0

The code has a type error

$sqll is not defined.it must be $result = mysql_query($sql).

I believe this is the reason you are looking for...(since the question is too vague which is probably because you got an error that you couldnt track)

answered Jan 11 '12 at 05:17

rjv

6,058
5
27
49

score -1 · Answer 4 · answered Jan 11 '12 at 05:15

-1

From my knowledge best way to use like this:

if $family is not string

$sql = "SELECT email FROM family WHERE family = ".$family;

if there is a string comparison then,

$sql = "SELECT email FROM family WHERE family = '".$family."'";

answered Jan 11 '12 at 05:15

srbhbarot

1,317
12
16

Either case is seriously dangerous with out emphasizing sanitizing inputs. Really though the developer shouldn't have to worry about that, just put a ? in it's place and use bound parameters or PDO instead. – atxdba Jan 11 '12 at 05:20
@Mischa He is in confusion. He asked what is the right way so from my knowledge i just try to help him nothing else. – srbhbarot Jan 11 '12 at 05:27
@srbhbarot Although your intention is good, you're not addressing the problem with the solution. Your code looks vulnerable to SQL injections, which probably is the reason you got downvoted. – Repox Jan 11 '12 at 07:15

score -2 · Answer 5 · answered Jan 11 '12 at 05:05

-2

'$family' no need of single quotes here

answered Jan 11 '12 at 05:05

maxjackie

22,386
6
29
37

Yes there is... (assuming `$family` is a string) – Mischa Jan 11 '12 at 05:06

Mysql fetch PHP variable

5 Answers5