PHP if statement with a MySQL query

Question

Is there a way to do an if statement like this:

if ($password == mysql_query("SELECT password from member WHERE id = $id")) {

// f00

}

So what I mean is, if it is possible and/or good practice to have a short query in your if, instead of extracting it from your DB first.

Thanks!

You might want to consider, Not doing it like that. What if mysql_query fails? What happens then? I would move the query-execution above the if-statement. — Filip Ekberg
– Filip Ekberg, Commented Feb 9, 2011 at 22:49
You must parse result from query to array or object. Then check — nyanev
– nyanev, Commented Feb 9, 2011 at 22:51
you have a SQL-injection hole in that code, change WHERE id = $id" to WHERE id = '$id'" *(note the single quotes around $id, otherwise mysql_real_escape_string() will not protect you. — Johan
– Johan, Commented May 28, 2011 at 19:34
Why aren't people using PDO instead of the horribly dangerous mysql_query function? — tadman
– tadman, Commented Jan 22, 2012 at 3:27

user557846 · Accepted Answer · 2011-02-09 22:49:01Z

1

mysql_query returns a resource so it wont work

answered Feb 9, 2011 at 22:49

user557846

Sign up to request clarification or add additional context in comments.

2 Comments

bjornars Over a year ago

He knows that, he is wondering if there is a similar single-statement that will accomplish what he's after.

user557846 Over a year ago

it was not clear to me, based on what he posted, that he knew it. Looking at the other answers\comments, I'm not the only one either.

Will · Accepted Answer · 2011-02-09 22:51:53Z

0

I wouldn't recommend it. If there is an error in the SQL, if you can't connect to the server, if there are no rows returned, or if there are any other errors then you'd have some big problems.

answered Feb 9, 2011 at 22:51

Will

1,61915 silver badges20 bronze badges

Comments

Jason Benson · Accepted Answer · 2011-02-09 22:53:28Z

0

Sure it's possible but it's not a good idea.

Consider if you were using a database abstraction layer instead of basic php_mysql like adodb

you could easily have:

   if($password == $DB->GetOne('Select password from member where id = '.$ID)){
        //do something
   }

However if the query failed or otherwise returned anything you were implicitly expecting you could have unforeseen errors.

You should encapsulate database output and database queries so that if they fail, they fail gracefully and do not have weird side effects that could be a pain to track down later.

answered Feb 9, 2011 at 22:53

Jason Benson

3,3981 gold badge23 silver badges21 bronze badges

Collectives™ on Stack Overflow

PHP if statement with a MySQL query

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related