Php variables in for selecting in my mysql query

Question

I try to make a selection in SQL using php variables. The code is like this:

$st=$_POST["st"] ;
$tu=$_POST["tu"] ; 
$data=$_POST["data"];
$ec= $_POST["ec"] ;

$sql="SELECT nr, '.$ec.' FROM 'report' WHERE st='.$st.' and tu='.$tu.' and dataupdate='.$data.'";

but I get 0 results.

If I change variables from the SQL query with values, it works. Also I test with

echo $st ; 
echo $tu ; 
echo $data ; 
echo $ec ;

and it returns correct value of post. Can anybody tell me what I do wrong ?

your sql is wrong. you can echo the $sql and try it on phpmyadmin to check weather its correct. — Athi Krishnan
– Athi Krishnan, Commented Oct 27, 2015 at 9:54
this error happened because you don't around your string variables with quotes. P.S. you can also use sprintf to avoid sql-injection. Or, better, use PDO — Sergio Ivanuzzo
– Sergio Ivanuzzo, Commented Oct 27, 2015 at 9:58

Community · Accepted Answer · 2017-05-23 12:15:10Z

1

First, you're mixing string concatenation using . with replacing variable names directly inside a string quoted using ". You need to choose one of the approaches:

"SELECT '$ec' ..."
"SELECT '" . $ec . "' ..."

Second, your way to build the SQL query is very dangerous as it allows SQL Injection attack. Use parameterized queries instead: parameters in MySQLi

edited May 23, 2017 at 12:15

CommunityBot

11 silver badge

answered Oct 27, 2015 at 9:57

Jiri Tousek

12.5k5 gold badges33 silver badges45 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

CodeLove · Accepted Answer · 2015-10-27 10:04:14Z

1

Your right query

$sql="SELECT nr, '".$ec."' FROM 'report' WHERE st='".mysql_escape_string($st)."' and tu='".mysql_escape_string($tu)."' and dataupdate='".mysql_escape_string($data)."'";

edited Oct 27, 2015 at 10:04

answered Oct 27, 2015 at 9:54

CodeLove

4604 silver badges14 bronze badges

1 Comment

Sergio Ivanuzzo Over a year ago

I feel the Dark Side of the Force! I feel sql-injection here

Jazi · Accepted Answer · 2015-10-27 10:56:54Z

0

Try this:

$st   = $_POST["st"];
$tu   = $_POST["tu"]; 
$data = $_POST["data"];
$ec   = $_POST["ec"];

$sql = "SELECT nr, $ec FROM `report` WHERE st='$st' and tu='$tu' and dataupdate='$data'";

edited Oct 27, 2015 at 10:56

Jazi

6,76215 gold badges64 silver badges94 bronze badges

answered Oct 27, 2015 at 9:53

sandeepsure

1,1251 gold badge10 silver badges17 bronze badges

3 Comments

Sergio Ivanuzzo Over a year ago

what about some sql-injection in your query?

sandeepsure Over a year ago

@SergioIvanuzzo you can use mysql_real_escape_string() to overcome this.

Sergio Ivanuzzo Over a year ago

I can, but instead I will use sprintf or PDO and prepare method :D

Collectives™ on Stack Overflow

Php variables in for selecting in my mysql query

3 Answers 3

Comments

1 Comment

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

1 Comment

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related