Placing a PHP variable in a MySQL query

Question

I'm having issues placing a PHP variable in MySQL string,

<?php
$con=mysqli_connect("***","***","***","***");

function getItem($itemNo)
{
    if (mysqli_connect_errno())
    {
        echo "Failed to connect to MySQL: " . mysqli_connect_error();
    }

    $result = mysqli_query($con,"SELECT * FROM products WHERE product_id = '$itemNo'");

    echo $itemNo;
    echo "<br>";
    while($row = mysqli_fetch_array($result))
    {
        echo $row['product_id'] . " " . $row['product_name'];
        echo "<br>";
    }
}
getItem(1001);
mysqli_close($con);

?>

The page shows my echo of the $itemNo, but thats all. If I just do select * from products, it gives my entire table like it should, so I know the database is working, so I've narrowed it down to the placement of the variable.

EDIT:

product_id column is an int and also the primary key.

what is the type of product_id ? if the type is int or bigint then just use $result = mysqli_query($con,"SELECT * FROM products WHERE product_id = $itemNo"); — user3470953
– user3470953, Commented Apr 21, 2014 at 6:31
Is that your actual database login in your supplied code? Surely that's something you should be keeping to yourself? — Jimmy Thompson
– Jimmy Thompson, Commented Apr 21, 2014 at 6:41
As Jimmy mentioned, you've left your login data. An edit was done to remove it, but people can always see the history. It would be advisable to change both login and password on your end. — Blizz
– Blizz, Commented Apr 21, 2014 at 6:43
Just a sidenote, which you probably already know. Dont do this "SELECT * FROM products WHERE product_id = '$itemNo'" unless you are making software just for yourself. One can SQL-inject to that code pretty much anything they want. — raPHPid
– raPHPid, Commented Apr 21, 2014 at 6:55

rmcfrazier · Accepted Answer · 2014-04-21 06:48:47Z

2

You can try a prepared statement to make using variables in your queries easier.

$stmt = $con->prepare("SELECT * FROM products WHERE product_id=?");
$stmt->bind_param($itemNo);
$stmt->execute();
$stmt->close();

edited Apr 21, 2014 at 6:48

answered Apr 21, 2014 at 6:36

rmcfrazier

4444 silver badges8 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Bender · Accepted Answer · 2014-04-21 06:49:43Z

1

 $result = mysqli_query($con,"SELECT * FROM products WHERE product_id = " .$itemNo );

answered Apr 21, 2014 at 6:49

Bender

71511 silver badges26 bronze badges

Collectives™ on Stack Overflow

Placing a PHP variable in a MySQL query

2 Answers 2

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related