PHP Variable Passing not working in database call

Question

This works.

function get_distinct_size_for_bracelets() {
    $sql = "SELECT DISTINCT size FROM mytable WHERE id = 27 AND type='plastic' ORDER BY size";
}

This does not work and stops php dead with no error reporting.

 function get_distinct_size_for_bracelets($myvalue) {
    $sql = "SELECT DISTINCT size FROM mytable WHERE id = 27 AND type=".$myvalue." ORDER BY size";
}

I have tried a number of configurations and nothing is working.

Joseph Mansfield · Accepted Answer · 2009-08-05 15:42:06Z

2

function get_distinct_size_for_bracelets($myvalue) {
    $sql = "SELECT DISTINCT size FROM mytable WHERE id = 27 AND type='".$myvalue."' ORDER BY size";
}

You still need the single quotes in the SQL query.

answered Aug 5, 2009 at 15:42

Joseph Mansfield

111k22 gold badges249 silver badges329 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Jeff Over a year ago

Thanks. That was it. I have single quotes elsewhere in my database calls using arrays. So I don't know why this call would require a different syntax.

Joseph Mansfield Over a year ago

I think perhaps you've misunderstood the edit. If $myvalue was equal to "foo", using your original script, the SQL would have become "type=foo" and in SQL this means "type attribute is equal to foo attribute". With my edit, the SQL becomes "type='foo'" which means "type attribute equals the string 'foo'".

marramgrass · Accepted Answer · 2009-08-05 15:42:27Z

2

Remember to quote the passed value:

function get_distinct_size_for_bracelets($myvalue) 
{ 
$sql = "SELECT DISTINCT size FROM mytable WHERE id = 27 AND type=".$myvalue." ORDER BY size";
}

Should be:

function get_distinct_size_for_bracelets($myvalue) 
{ 
$sql = "SELECT DISTINCT size FROM mytable WHERE id = 27 AND type='".$myvalue."' ORDER BY size";
}

Note the added single quotes at type.

answered Aug 5, 2009 at 15:42

marramgrass

1,41111 silver badges17 bronze badges

Comments

ftdysa · Accepted Answer · 2009-08-05 15:42:41Z

2

You need single quotes around it still. So

$sql = "SELECT DISTINCT size FROM mytable WHERE id = 27 AND type='".$myvalue."' ORDER BY size";

answered Aug 5, 2009 at 15:42

ftdysa

1,2426 gold badges17 silver badges26 bronze badges

Comments

Parrots · Accepted Answer · 2009-08-05 15:43:26Z

2

You're not escaping your value and you're forgetting your single quotes, that'd be my guess. Try:

function get_distinct_size_for_bracelets($myvalue) { 
    $query = sprintf("SELECT DISTINCT size FROM mytable WHERE id = 27 AND type='%s'  ORDER BY size",
        mysql_real_escape_string($myvalue));
}

That lets you pass an escaped value into the string, as opposed to using concatenation.

answered Aug 5, 2009 at 15:43

Parrots

27k14 gold badges61 silver badges78 bronze badges

Comments

Justin Giboney · Accepted Answer · 2009-08-05 15:43:13Z

0

try

function get_distinct_size_for_bracelets($myvalue) {
    $sql = "SELECT DISTINCT size FROM mytable WHERE id = 27 AND type='".$myvalue."' ORDER BY size";
}

answered Aug 5, 2009 at 15:43

Justin Giboney

3,3012 gold badges21 silver badges19 bronze badges

Comments

Gumbo · Accepted Answer · 2009-08-05 15:44:24Z

0

MySQL has different data types too. And strings need to be enclosed in quotes too:

$sql = "SELECT DISTINCT size FROM mytable WHERE id = 27 AND type='".$myvalue."' ORDER BY size";

Or better with additional use of the mysql_real_escape_string function:

$sql = "SELECT DISTINCT size FROM mytable WHERE id = 27 AND type='".mysql_real_escape_string($myvalue)."' ORDER BY size";

answered Aug 5, 2009 at 15:44

Gumbo

657k112 gold badges792 silver badges852 bronze badges

Collectives™ on Stack Overflow

PHP Variable Passing not working in database call

6 Answers 6

2 Comments

Comments

Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

6 Answers 6

2 Comments

Comments

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related