PHP variable not working in MySQLi statement

Question

I have the following code:

$indtag = '';
foreach($pretag as &$indtag) { //cycles through tags, puts quotes into check by tag
    $quote = mysqli_query($mysqli, "SELECT `id`, `$indtag` FROM `beyonce` WHERE `$indtag` LIKE '%$indtag%'");
        while($row = mysqli_fetch_assoc($quote)) {
            echo $row['$indtag'];
            echo $row['id'];
        }
}

The table has fields for ids, quotes, then an individual column for each tag (ang for anger being an example). pretag is an array full of tags (rom is romance, ang is anger, dece is deception) that I'm running through, trying to find quotes with those IDs and tags. The statement works fine in SQL when I run it with ang, it selects the IDs fine, but when I try to select the column/field for a tag using a variable, nothing comes back. Any ideas?

WARNING: When using mysqli you should be using parameterized queries and bind_param to add user data to your query. DO NOT use string interpolation to accomplish this because you will create severe SQL injection bugs. Additionally, try to a void using dynamic column names unless you've very carefully screened them against a known-good list. — tadman
– tadman, Commented Jan 16, 2015 at 17:49
Any particular reason why foreach($pretag as &$indtag) by reference? — Mark Baker
– Mark Baker, Commented Jan 16, 2015 at 17:51
I'm actually fairly alarmed that you have a table named beyonce... — castis
– castis, Commented Jan 16, 2015 at 17:51
I'm not sure this is your whole problem, but I don't think this line would work. echo $row['$indtag']; I think that need to be double qouted. — BrokenBinary
– BrokenBinary, Commented Jan 16, 2015 at 18:06

AbraCadaver · Accepted Answer · 2015-01-16 17:57:24Z

2

You're using the variable $indtag where you should be using the column name indtag:

SELECT `id`, `$indtag` FROM `beyonce` WHERE `$indtag` LIKE '%$indtag%'
              ^                              ^

And as @tadman points outs, don't do it this way, use mysqli_stmt_bind_param with a prepared statement or you are in for a wild ride.

edited Jan 16, 2015 at 17:57

answered Jan 16, 2015 at 17:49

AbraCadaver

79.2k7 gold badges75 silver badges91 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

BrokenBinary Over a year ago

I'm pretty sure the column being selected is not indtag but is actually dynamically changing. Based on the question, the value of $indtag could be 'ang', 'rom', 'dece', ... etc.

BrokenBinary Over a year ago

I'm specifically referring to this line: The table has fields for ids, quotes, then an individual column for each tag (ang for anger being an example).

Robert M. C. Forster Over a year ago

BrokenBinary is correct in this, it is a dynamically changing column.

AbraCadaver Over a year ago

So this is a valid example: SELECT id, rom FROM beyonce WHERE rom LIKE '%rom%' ???

AbraCadaver Over a year ago

OK, that is a horrendous design, but look at @BrokenBinary's comment on the OP.

|

BrokenBinary · Accepted Answer · 2015-01-16 19:08:07Z

0

This line in your code doesn't need quotes.

echo $row['$indtag'];  // Won't work
echo $row[$indtag];    // Will work

answered Jan 16, 2015 at 19:08

BrokenBinary

7,9493 gold badges46 silver badges55 bronze badges

Collectives™ on Stack Overflow

PHP variable not working in MySQLi statement

2 Answers 2

6 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

6 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related