I have the following problem:
I am trying to select a result from a MySQL database table, depending on the category value:
$sql = mysql_query("SELECT * FROM products WHERE category='garniture' ORDER BY date_added DESC LIMIT 2");
The problem is that I don't want to use a static value for category (like 'garniture'), but I want this to be determined by a variable value (let's say that variable is $category). How can I manage this?
Without getting into the fact that you should not be using the MySQL Library anymore, use MySQLi or PDO instead, you would insert a variable in that string as such:
$sql = mysql_query("SELECT * FROM products WHERE category='$category' ORDER BY date_added DESC LIMIT 2");
Or if you find it easier to read:
$sql = mysql_query("SELECT * FROM products WHERE category='" . $category . "' ORDER BY date_added DESC LIMIT 2");
mysql_ library and then proceeded to do so; it might be better if you showed how to do it the correct way instead of encouraging bad habits. In fact your answer leaves the OP wide open to SQL injection. I would not recommend this approach at all
$category it can easily be manipulated. It's better to use prepared statements, however in this case, this variable is not even being escaped. Note that Madness understands this with the reference to PDO or mysqli. I was just suggesting it would be better to show the OP the safer way
$sql = mysql_query("SELECT * FROM products WHERE category='$category' ORDER BY date_added DESC LIMIT 2");
Just put the variable where you want it in the string.
The most important feature of double-quoted strings is the fact that variable names will be expanded. See string parsing for details.
