how to use session value in sql query in php ?

Question

I want to use session's name in my sql query. I dont know how to compare values in sql query using session. And is it safe to compare session's value in sql query. I am getting this error-

( ! ) Parse error: syntax error, unexpected T_VARIABLE in ****www\1lab\my-status.php on line 53

At top of htmlpage-:

  session_start();
   if(!isset($_SESSION['check']) or ($_SESSION['check'])!=='*****' or         !isset($_SESSION['uname']) )
    {
       header('location:index.php');
    }

in between html page-:

   include 'config.php';
   $list="select * from books where b_issued = "$_SESSION['uname']"";
   $data=mysqli_query($con,$list); 
   while($info = mysqli_fetch_array($data))
   {
     echo $info['b_name']."<br><br>";
   }

like this .. $list="select * from books where b_issued ='".$_SESSION['uname']."'"; — user1844933
– user1844933, Commented Feb 14, 2014 at 11:43
Although ghost's comment is very ugly and badly mannered, he does have a point. The mysql extension has been deprecated for some time in PHP, and it is very strongly advised to use either the MySQLi or PDO extensions instead. — Tularis
– Tularis, Commented Feb 14, 2014 at 11:45

Tularis · Accepted Answer · 2014-02-14 11:42:43Z

2

Change your line 53 from:

$list="select * from books where b_issued = "$_SESSION['uname']"";

to:

$list="select * from books where b_issued = " . $_SESSION['uname'];

Your problem is caused by not concatenating 2 strings. Instead you just stick one after the other and PHP has no idea what to do with the variable ($_SESSION) right after a string. Should it get rid of it? concatenate it? It just doesn't know, unless you tell it (eg. by using the dot, which is the concatenation operators

answered Feb 14, 2014 at 11:42

Tularis

1,5061 gold badge8 silver badges17 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

zarpio · Accepted Answer · 2014-02-14 11:53:14Z

1

Correct your this line, there is concatenation error.

   $list="select * from books where b_issued = ".$_SESSION['uname'];

OR you can do it like this, take your $_SESSION['uname'] in a variable and pass it to the query.

   $username = $_SESSION['uname'];
   $list="select * from books where b_issued = $username";

answered Feb 14, 2014 at 11:53

zarpio

7,3688 gold badges64 silver badges75 bronze badges

4 Comments

user3292058 Over a year ago

(mysqli_fetch_array() expects parameter 1 to be mysqli_result, boolean given in C:\wamp\www\1lab\my-status.php on line 58)

zarpio Over a year ago

Please print your query which is $list"..." and share output here.

user3292058 Over a year ago

echo $list working perfectly and getting the value of username.. but still get error which i show you before in line 58

zarpio Over a year ago

Debug your code using "or die(mysql_error())"... add $data=mysqli_query($con,$list) or die(mysql_error());

King-of-IT · Accepted Answer · 2014-02-14 13:12:35Z

1

try below code.and make sure that * you have passed as session argument are same as you have set anywhere.For example,if you have set 5 * then use 5 * in session argument and then try below code.

session_start();
if(!isset($_SESSION['check']) or $_SESSION['check']!='*****' or !isset($_SESSION['uname']))
{
   header('location:index.php');
}

include 'config.php';
$list="select * from books where b_issued = '".$_SESSION['uname']."'";
$data=mysqli_query($con,$list); 
while($info = mysqli_fetch_array($data))
{
  echo $info['b_name']."<br><br>";
}

answered Feb 14, 2014 at 13:12

King-of-IT

5434 silver badges18 bronze badges

Comments

Shankar Narayana Damodaran · Accepted Answer · 2014-02-25 07:26:07Z

1

You forgot the concatenate operator

$list="select * from `books` where `b_issued` = ".$_SESSION['uname'];
                                              // ^------ Here

edited Feb 25, 2014 at 7:26

answered Feb 14, 2014 at 11:42

Shankar Narayana Damodaran

68.6k43 gold badges102 silver badges129 bronze badges

Comments

d.abyss · Accepted Answer · 2014-02-14 12:00:41Z

0

As has been said before, you need to use the concatenate operator to tell php to 'add' this session variable to the SQL query. Alternatively, you can use prepared statements which are far better in terms of security. Also, you should escape anything that interacts with your database, even if it originates from the database!

$list="select * from books where b_issued = ?";
$uname = htmlentities($_SESSION['uname']);
$stmt = $con->prepare($list);
$stmt->bind_param('s', $uname);
$stmt->execute();
$res = $stmt->get_result();
while ($row = $res->fetch_array(MYSQLI_ASSOC)) 
    {
        echo $row['b_name']."<br><br>";
    };

answered Feb 14, 2014 at 12:00

d.abyss

2121 gold badge5 silver badges26 bronze badges

Comments

Andy Holmes · Accepted Answer · 2014-02-14 12:09:28Z

0

The proper syntax for line 53 should be :

$list="select * from `books` where `b_issued` = '".$_SESSION['uname']."'";

Hope session value for 'uname' is a string.

edited Feb 14, 2014 at 12:09

Andy Holmes

8,10711 gold badges56 silver badges93 bronze badges

answered Feb 14, 2014 at 11:49

Pinu

4124 silver badges4 bronze badges

Comments

user3292058 · Accepted Answer · 2014-02-14 12:37:17Z

0

it works with $list="select * from books where b_issued = '{$_SESSION['uname']}'";

answered Feb 14, 2014 at 12:37

user3292058

611 silver badge8 bronze badges

Collectives™ on Stack Overflow

how to use session value in sql query in php ?

7 Answers 7

Comments

4 Comments

Comments

Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

7 Answers 7

Comments

4 Comments

Comments

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related