PHP and MYSQL - Querying A Variable

Question

Ok, I have this PHP $_POST['username'] variable and I need to query everything on the user via MYSQL. The only problem is it keeps throwing me errors.

something like

$user = $_POST['username'];
$query = mysql_query("SELECT * FROM user WHERE username = $user");

I've tried

$query = mysql_query("SELECT * FROM user WHERE username = `$user`");
$query = mysql_query("SELECT * FROM user WHERE username = ".$user);

Not sure what i'm doing wrong.

what errors???? (Ignore the excessive question marks, they are there to circumvent the comment character limit. I am not surprised, just asking what the errors are.) — aib
– aib, Commented Jul 4, 2011 at 3:18
DO NOT directly use user input in a query string. DO read about SQL injection. DO read about parameterized queries. — aib
– aib, Commented Jul 4, 2011 at 3:23

OMG Ponies · Accepted Answer · 2011-07-04 03:18:58Z

1

Your problem is that strings in SQL need to be enclosed in single quotes.

The most preferable approach would be to use PDO. But sprintf (along with mysql_real_escape_string) is a better interim approach that what is posted:

$query = sprintf("SELECT u.* 
                    FROM USER u
                   WHERE u.username = '%s'",
                  mysql_real_escape_string($_POST['username']));

$result = mysql_query($query);

Lest we forget Little Bobby Tables ;)

answered Jul 4, 2011 at 3:18

OMG Ponies

334k85 gold badges536 silver badges508 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

SeanCannon · Accepted Answer · 2011-07-04 03:13:49Z

1

$user = $_POST['username'];
$query = ('SELECT * FROM user WHERE username LIKE "' . $user . '"');

answered Jul 4, 2011 at 3:13

SeanCannon

78.1k17 gold badges126 silver badges145 bronze badges

Comments

afaolek · Accepted Answer · 2011-07-04 03:15:02Z

0

Use this:

$query = mysql_query("SELECT * FROM user WHERE username = '$user'");

answered Jul 4, 2011 at 3:15

afaolek

8,89114 gold badges47 silver badges60 bronze badges

Collectives™ on Stack Overflow

PHP and MYSQL - Querying A Variable

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related