Cant insert string into mysql query

Question

I'm trying to make a login page in PHP, and I'm trying to construct the query here:

$q = 'SELECT * FROM users WHERE userid="'+$username+'"';

When I echo it out with

echo $q

I get 0. When I do

$q = 'SELECT * FROM users WHERE userid="'+"test"+'"';

I get 0. When I do

$q = 'SELECT * FROM users WHERE userid="michael"';

I get my expected result of the string being printed out

+ is for math in PHP. Use a . You also might be open to SQL injections with this code, best to parameterize your query. Also userid will probably never equal $username. — chris85
– chris85, Commented Jul 25, 2017 at 2:15
SQL injection, take care, whats the datatype of userid ? its not javascript — Akshay Hegde
– Akshay Hegde, Commented Jul 25, 2017 at 2:15
Possible duplicate of How to combine two strings together in PHP? — chris85
– chris85, Commented Jul 25, 2017 at 2:16
Its in an If statement, and I check for SQL injection in the username and password, and userid is a VARCHAR. — Michael
– Michael, Commented Jul 25, 2017 at 2:20

Kevin P · Accepted Answer · 2017-07-25 02:15:46Z

1

Use a . for concatenation, also don't forget to clean the data to prevent mysql injection.

$user_id = 'test';
$q = 'SELECT * FROM users WHERE userid="' . $user_id . '"';

answered Jul 25, 2017 at 2:15

Kevin P

6053 silver badges9 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Chris · Accepted Answer · 2017-07-25 02:29:12Z

0

Try using a PDO Prepared statement to protect yourself from SQL injection.

$q = 'SELECT * FROM users WHERE userid = ?';
$stmt = $dbh->prepare($q);
if ($stmt->execute(array($username))) {
  while ($row = $stmt->fetch()) {
    print_r($row);
  }
}

http://php.net/manual/en/pdo.prepared-statements.php

answered Jul 25, 2017 at 2:29

Chris

34 bronze badges

Comments

Risa__B · Accepted Answer · 2017-07-25 02:32:47Z

0

you can use .

$user_id = 'michael';
$q = 'SELECT * FROM users WHERE userid="'.$user_id.'"';

or use double quotes for the expression and use single quotes for the variables

$user_id = 'michael';
$q = "SELECT * FROM users WHERE userid='$user_id'";

im Believe the second option is smallest and easiest to remember

answered Jul 25, 2017 at 2:32

Risa__B

4624 silver badges8 bronze badges

Collectives™ on Stack Overflow

Cant insert string into mysql query

3 Answers 3

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related