Database query not functioning as expected

Question

Hi i'm using a query to extract data from the table, from a dynamic link. and ummm the code I've used SEEMS to be okay, yet i get a 'Database Query Failed' can someone tell me why?

here's the code:

<?php
$PIN = $_GET['Pin'];

$query="SELECT * FROM Accident_Investigation WHERE PIN = $PIN";
$result = mysqli_query($connection, $query);

if(!$result){
    die("Database query failed.");
    } 
?>

Instead of die(), use echo mysqli_error($connection); and read the error message that outputs (if any). — Amal
– Amal, Commented Nov 25, 2013 at 16:51
Maybe connection isn't defined. Maybe PIN is a string and should be in quoatas? — Kelu Thatsall
– Kelu Thatsall, Commented Nov 25, 2013 at 16:53
Lovely SQL injection attack vulnerability. Enjoy having your server pwn3d. — Marc B
– Marc B, Commented Nov 25, 2013 at 17:00

George · Accepted Answer · 2013-11-25 16:54:54Z

1

Change $PIN to '$PIN' in SQL statement provided everything else works fine.

edited Nov 25, 2013 at 16:54

George

36.8k9 gold badges70 silver badges109 bronze badges

answered Nov 25, 2013 at 16:53

Prashant G

4,9303 gold badges38 silver badges47 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Joachim Isaksson Over a year ago

Also mysqli_real_escape_string will be useful.

Frederik Spang Over a year ago

Sanitize the string before directing it directly from $_GET.

Prashant G Over a year ago

Yes, one can refer to this link => php.net/manual/en/filter.filters.sanitize.php SQL injection prevention are next steps.

DevlshOne · Accepted Answer · 2013-11-25 17:03:44Z

0

$PIN = (!isset($_GET['Pin']) ? $_GET['Pin'] : null);
$query = "SELECT * FROM Accident_Investigation WHERE PIN = '" . $PIN . "'";
$result = mysqli_query($connection, $query);
if (!$result){
  mysqli_error($connection);
  die("Database query failed.");
}

edited Nov 25, 2013 at 17:03

answered Nov 25, 2013 at 16:57

DevlshOne

8,4671 gold badge31 silver badges38 bronze badges

4 Comments

Frederik Spang Over a year ago

If PIN is an int, it shouldn't, AFAIK be in quotes, should it?

Marc B Over a year ago

Do NOT use empty() like this, ESPECIALLY if the valid inputs can contain 0. empty(0) is true.

DevlshOne Over a year ago

If it does happen to be an int, it won't matter. But if it happens to be a date, char or varchar, it sets things straight.

user2993497 Over a year ago

thanks mann, what i had to do was to add the quotes to $PIN. like so WHERE PIN = '$PIN'

Collectives™ on Stack Overflow

Database query not functioning as expected

2 Answers 2

3 Comments

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related