Adding session variable into MYSQL query using PHP

Question

Im trying to pass two variables into a mysql query, and its getting stuck when passing the session variable in below:

$check = mysql_query("SELECT * 
                      FROM Clients 
                      WHERE Username = '$new_username' 
                      AND Username != '$_SESSION['Username']'") or die(mysql_error());

Any tips? Thanks in advance.

Try this "SELECT * FROM Clients WHERE Username = '$new_username' AND Username != '".$_SESSION['Username']."'" — Shakti Singh
– Shakti Singh, Commented Feb 11, 2011 at 12:24
"Getting stuck" isn't really an error message. What output is this generating? — Michael Robinson
– Michael Robinson, Commented Feb 11, 2011 at 12:27
I hope you see now that your question has nothing to do with sessions nor with mysql, but just PHP strings syntax issue — Your Common Sense
– Your Common Sense, Commented Feb 11, 2011 at 12:34
Also note Salman's answer. SQL injections is a thing to avoid... — Your Common Sense
– Your Common Sense, Commented Feb 11, 2011 at 12:36

Michiel Pater · Accepted Answer · 2011-02-11 12:29:38Z

12

It is because your single quotes '$_SESSION['Username']' have been ended by the value in the session. Changing this to '" . $_SESSION['Username'] . "' will solve the problem.

answered Feb 11, 2011 at 12:29

Michiel Pater

23.2k5 gold badges47 silver badges58 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Salman Arshad · Accepted Answer · 2015-02-18 08:31:56Z

8

This will work but this is VERY, VERY BAD:

$check = mysql_query("
    SELECT * 
    FROM  Clients 
    WHERE Username = '$new_username' 
    AND   Username != '{$_SESSION['Username']}'
") or die(mysql_error());

This too shall work and recommended way of doing it:

$check = mysql_query("
    SELECT * 
    FROM  Clients 
    WHERE Username  = '" . mysql_real_escape_string($new_username) . "' 
    AND   Username <> '" . mysql_real_escape_string($_SESSION['Username']) . "'
") or die(mysql_error());

edited Feb 18, 2015 at 8:31

answered Feb 11, 2011 at 12:32

Salman Arshad

274k85 gold badges450 silver badges540 bronze badges

Comments

Crusader · Accepted Answer · 2014-08-06 14:06:46Z

1

Why no one say about "text text $array[key] text" syntax?

SELECT * 
FROM  Clients 
WHERE Username = '$new_username' 
AND   Username != '$_SESSION[Username]'

answered Aug 6, 2014 at 14:06

Crusader

1,21012 silver badges23 bronze badges

Comments

Mārtiņš Briedis · Accepted Answer · 2011-02-11 12:32:53Z

0

When you embed arrays in to strings, you have to seperate them by concatenating them or using curly braces.

$string = "text text {$array['key']} text";

or

$string = "text text " . $array['key'] . " text";

answered Feb 11, 2011 at 12:32

Mārtiņš Briedis

17.9k5 gold badges59 silver badges78 bronze badges

Collectives™ on Stack Overflow

Adding session variable into MYSQL query using PHP

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related