Getting php variable to select statement not working

Question

Here i am trying to pass the variable to php select query,but its not working. couldn't figure out what is the problem.

code:

<?php   
$cname =  $_GET['c_name'];
    include 'config.php';
    $conn = mysqli_connect($dbhost, $dbuser, $dbpass, $dbname);
    if(! $conn )
    {
        die('Could not connect: ' . mysql_error());
    }
    $sql = 'SELECT * FROM co_details where co_name="$cname"';
    $result = mysqli_query($conn, $sql);
    if (mysqli_num_rows($result) > 0) 
    {
    while($row = mysqli_fetch_assoc($result)) 
    {
        echo "<br>";
        echo "Course Details <br>";
        echo $row['co_name']."<br>";
        echo $row['co_objectives']."<br>";
        echo $row['co_outline']."<br>";
        echo $row['co_prereq']."<br>";
        echo $row['co_fee']."<br>";
        echo $row['co_duration']."<br>";
    }
    mysqli_close($conn);
    }
?>

what may be the reason? Instead of variable $cname if i put the direct value then the query is executing successfully.

Firstly, you're mixing APIs with mysql_error() - That function does not intermix with mysqli_ functions. Use mysqli_error($conn) as per the manual php.net/manual/en/mysqli.error.php — Funk Forty Niner
– Funk Forty Niner, Commented Feb 20, 2015 at 4:44
first echo the $sql and check $cname is passed in your query or not — user3386779
– user3386779, Commented Feb 20, 2015 at 4:46

Kevin · Accepted Answer · 2015-02-20 06:59:29Z

Note that single quoted strings like this one you have:

$sql = 'SELECT * FROM co_details where co_name="$cname"';

That variable that you think you have there will not get interpolated. It will only work by using double quoted strings.

$sql = "SELECT * FROM co_details where co_name='$cname'";

And as @Fred has said in the comments, stick with MySQLi including your connection error:

if(! $conn )
{
    die('Could not connect: ' . mysql_error()); // mysql API doesn't belong
}

Change it to MySQLi interface:

if ($conn->connect_errno) {
    die('Could not connect: ' . $conn->connect_error);
}

And you should have used prepared statements instead as this is prone to SQL injection.

<?php   

if(!empty($_GET['c_name'])) {
    $cname =  $_GET['c_name'];  
    include 'config.php';
    $conn = mysqli_connect($dbhost, $dbuser, $dbpass, $dbname);
    if ($conn->connect_errno) {
        die('Could not connect: ' . $conn->connect_error);
    }

    $sql = 'SELECT co_name, co_objectives, co_outline, co_prereq, co_fee, co_duration FROM co_details WHERE co_name = ?';
    $select = $conn->prepare($sql);
    $select->bind_param('s', $cname);
    $select->execute();
    $select->store_result();
    $select->bind_result($co_name, $co_objectives, $co_outline, $co_prereq, $co_fee, $co_duration);

    while($select->fetch()) {
        echo "<br/>
        Course Details: <br/>
        $co_name <br/>
        $co_objectives <br/>
        $co_outline <br/>
        $co_prereq <br/>
        $co_fee <br/>
        $co_duration <hr/>
        ";
    }

}

?>

@Fred-ii- yeah that'll spew an error when the connection fails

iqbalmp · Accepted Answer · 2015-02-20 04:46:12Z

0

You can't use $cname directly in the string: try as shown below:

 $sql = "SELECT * FROM co_details where co_name='".$cname."'";

Hope, it helps!

answered Feb 20, 2015 at 4:46

iqbalmp

6771 gold badge14 silver badges24 bronze badges

2 Comments

user3386779 Over a year ago

'.' is not needed in this query

mickmackusa Over a year ago

Directly injecting php variables into your query in this case is not best practice.

varad mayee · Accepted Answer · 2015-02-20 04:59:34Z

0

You are using single quote don't do like that change the query like this

$sql = "SELECT * FROM co_details where co_name='$cname'";

answered Feb 20, 2015 at 4:59

varad mayee

6197 silver badges19 bronze badges

1 Comment

mickmackusa Over a year ago

Directly injecting php variables into your query in this case is not best practice.

Collectives™ on Stack Overflow

Getting php variable to select statement not working

3 Answers 3

1 Comment

2 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related