Php using a variable in a string (concatenation)

Question

why i can't use this code ? and could anyone tell me what is the correct code ?

$lfr_prfid = "profile='$log_id'";

$lfrsql = "SELECT * FROM friends WHERE user2='$log_id' AND accepted='1'";
$lfrquery = mysqli_query($db_conx, $lfrsql);

while ($lfrrow = mysqli_fetch_array($lfrquery, MYSQLI_ASSOC)) {

$lfr_id = $lfrrow["id"];
$lfr_user1 = $lfrrow["user1"];
$lfr_user2 = $lfrrow["user2"];

$lfr_prfid += " OR profile='".$lfr_user1."'";

}

the last line i wrote this ( += ) and the code doesn't work so how can i do this in another way ? so i can use this in a SELECT statement .

$psql = "SELECT * FROM posts WHERE ".$lfr_prfid." ORDER BY postdate DESC LIMIT 0,20";
$pquery = mysqli_query($db_conx, $psql);

Read about PHP's operators. The string operators would be relevant in this case. — Sverri M. Olsen
– Sverri M. Olsen, Commented Nov 23, 2013 at 19:26
You urgently need to read up on proper SQL escaping because this thing is riddled with SQL injection bugs. The bind_param method makes this safe and reliable. — tadman
– tadman, Commented Nov 23, 2013 at 20:20
Please accept the most helpful answer by clicking the checkmark to to the left of the answer, underneath the voting arrows. This will also award you some reputation points. If you haven't taken the SO tour, check it out here: stackoverflow.com/tour. — m59
– m59, Commented Jan 24, 2014 at 5:38

m59 · Accepted Answer · 2013-11-23 19:24:09Z

4

$lfr_prfid.=

Concatenate with . not with +. The + is concatenation in javascript.

so, in php: $myVar.= 'foo';

and in javascript: myVar+= 'foo';

Update based on your edit:

Please, DO NOT use that in a database query. Use prepared statements or your code is dangerous.

answered Nov 23, 2013 at 19:24

m59

43.9k14 gold badges122 silver badges139 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

Master Over a year ago

why it is dangerous ?

m59 Over a year ago

Read about prepared statements. It's more likely than not that someone could get use sql injection to do anything they want with your database. @Master

Master Over a year ago

thanks very much , but is there another way to do that statement ?

m59 Over a year ago

@Master prepared statements. Google it.

imulsion Over a year ago

@Master wrap the whole statement in this method: mysqli_real_escape_string() Or use prepared statements as m59 mentioned

|

Amal · Accepted Answer · 2013-11-23 19:37:57Z

2

Change your code to:

$lfr_prfid .= " OR profile='".$lfr_user1."'";

Concatenation in PHP is done with ., not with += as you have written.

Hope this helps!

edited Nov 23, 2013 at 19:37

Amal

76.8k18 gold badges133 silver badges154 bronze badges

answered Nov 23, 2013 at 19:27

sushant-hiray

1,8982 gold badges21 silver badges28 bronze badges

Collectives™ on Stack Overflow

Php using a variable in a string (concatenation)

2 Answers 2

Update based on your edit:

7 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Update based on your edit:

7 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related