PHP mysql variable

Question

yesterday i was doing work in php mysql i wrote a query

mysql_query("INSERT INTO `first` (`firstName`, `lastName`, `address1`,  `city`, `state`, `zip`, `country`, `amount`, `date`) VALUES ('$firstName','$lastName','$address1','$city','$state','$zip','$country','$amount','$date')")

it did not work for me and then my boss wrote below query

mysql_query("INSERT INTO `first` (`firstName`, `lastName`, `address1`,  `city`, `state`, `zip`, `country`, `amount`, `date`) VALUES ('".$firstName."','".$lastName."','".htmlentities($address1)."','".$city."','".$state."','".$zip."','".$country."','".$amount."','".$date."')");

and it works!!

is there anything wrong in first query..please help me out..

What was $address1? The only differences here is the use of htmlentities() in the second query. — Logan Serman
– Logan Serman, Commented Apr 17, 2012 at 13:15
Both are very, very wrong. You should be very afraid of SQL injection. Never insert variables this way. Check PDO and use parameters — Milan Halada
– Milan Halada, Commented Apr 17, 2012 at 13:16
@Uriel_SVK, I think the OP's confusion here stems from the use of double quotes in PHP. While you're right that parameterized queries are generally safer, how do you know those variables are not perfectly 'cleansed' before that query is executed? People are quick to play the SQL Injection card, even when it has nothing to do with the question. I know I am bitter. Still, +1 for a good suggestion. — Logan Serman
– Logan Serman, Commented Apr 17, 2012 at 13:19
If there is any single quote in $address, then the query stops the execution. You can use mysql_escape_string for escaping quotes. htmlentities converts the characters to html entities, so your boss's query has executed successfully. — nithi
– nithi, Commented Apr 17, 2012 at 13:22

Community · Accepted Answer · 2023-11-17 20:08:53Z

3

First query should work, but you got probably quotes in the content of your variables. Also, always use atleast mysql_real_escape_string. https://www.php.net/mysql_real_escape_string

Or even better, use PDO http://php.net/manual/en/book.pdo.php

edited Nov 17, 2023 at 20:08

CommunityBot

11 silver badge

answered Apr 17, 2012 at 13:18

LHolleman

2,5962 gold badges20 silver badges19 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Mohit Bumb · Accepted Answer · 2012-04-17 13:18:09Z

0

This function is identical to htmlspecialchars() in all ways, except with htmlentities(), all characters which have HTML character entity equivalents are translated into these entities.

answered Apr 17, 2012 at 13:18

Mohit Bumb

2,4935 gold badges33 silver badges54 bronze badges

Collectives™ on Stack Overflow

PHP mysql variable

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related