How to create new php file which include sql

Question

I want to create dynamically a new php file. Inside the new file i want my sql query. Here's my code

    $myfile = "".$file.".php"; // or .php  
    //echo $myFile;
    $fh = fopen($myfile, 'w'); // or die("error");  
    $stringData = '<?php

            $sql = "SELECT * FROM users, epixeir WHERE users.user = ".$_SESSION["user"]." AND user.pass = ".$_SESSION["pass"]." ;";
            $result = $conn->query($sql);
            ?>

    ';   
    fwrite($fh, $stringData);

In new file $myfile there is a "Notice: Trying to get property of non-object".

If i edit it to '".$_SESSION["user"]"' working fine, but this i want to do it dinamically. So if i write my above code like

    $myfile = "".$file.".php"; // or .php  
    //echo $myFile;
    $fh = fopen($myfile, 'w'); // or die("error");  
    $stringData = '<?php

            $sql = "SELECT * FROM users, epixeir WHERE users.user = '".$_SESSION["user"]."' AND user.pass = '".$_SESSION["pass"]."' ;";
          //$sql = "SELECT * FROM users, epixeir WHERE users.user = '".$_SESSION['user']."' AND user.pass = '".$_SESSION['pass']."' ;";
            $result = $conn->query($sql);
            ?>

    ';   
    fwrite($fh, $stringData);

Then i receive "Parse error: syntax error, unexpected '"' "

I'm confused and I need your help.

Did you try to escape your " character? Try this: $sql = "SELECT * FROM users, epixeir WHERE users.user = '".$_SESSION[\"user\"]."' AND user.pass = '".$_SESSION[\"pass\"]."' ;"; — James
– James, Commented Jun 8, 2015 at 19:15
The problem is in the first and last quot '".$_SESSION["user"]."' not there you say — user3746116
– user3746116, Commented Jun 8, 2015 at 19:17
I tried like you say in the first and it's ok, thank you and sorry for my fast answer — user3746116
– user3746116, Commented Jun 8, 2015 at 19:23

Community · Accepted Answer · 2017-05-23 11:51:09Z

1

You should use " instead of ' initially and then escape the other " you want in the string. In the example your string has ended in the second '. So all the rest is a syntax error. You can also use double quotes.

There is more information in these links:

Escaping quotation marks in PHP

How to escape strings in SQL Server using PHP?

edited May 23, 2017 at 11:51

CommunityBot

11 silver badge

answered Jun 8, 2015 at 19:15

Nelson Teixeira

6,6366 gold badges46 silver badges90 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

charles okojie · Accepted Answer · 2015-06-08 19:25:44Z

0

Try this....

$sql = "SELECT * FROM users, epixeir WHERE users.user = '".$_SESSION['user']."' AND user.pass = '".$_SESSION['pass']."'";

answered Jun 8, 2015 at 19:25

charles okojie

7282 gold badges10 silver badges23 bronze badges

1 Comment

user3746116 Over a year ago

In first code single quot will close $stringData. I tried myself. James gave me the answer, thank you

user2022742 · Accepted Answer · 2015-06-08 20:11:29Z

0

' is literal " is processed

If you start the string using ' the inner ' need to be escaped. If you star using ", the inner " need to be escaped.

If you use ' the inner variables won't be processed and your string will receive the variables as literal text.

If you use " the variables inside the string will be changed to values before the string is aserted to the variable.

You can escape characters using \ before the character that needs to be literal.

Examples:

$fruit = 'apple';

$ex1 = "I like $fruit"; // I like apple

$ex2 = 'I like $fruit'; // I like $fruit

or escaping special character:

$ex3 = "I like \$fruit"; // I like $fruit

$ex4 = "I like \"$fruit\""; // I like "apple"

answered Jun 8, 2015 at 20:11

user2022742

11

Collectives™ on Stack Overflow

How to create new php file which include sql

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related