building a sql query string with php parameters

Question

I'm trying to do this, but it returns null?

$query_1=$field_name[0]."='{".$field_value[0]."}'";

and then

getType = mysql_query("SELECT * FROM wines WHERE $query_1") or die(mysql_error());

while if i do like this:

 $getType = mysql_query("SELECT * FROM wines WHERE $field_name[0]='{$field_value[0]}'") or die(mysql_error());

it works fine.

is this even possible, or am I missing something too obvious? thank you in advance!

The solution is in the answers below, but you should really be aware that there is a high risk of SQL injection if you do it this way. Please sanitize your input before using it directly in a SQL query like this! — Wookai
– Wookai, Commented Nov 23, 2011 at 12:35

Jan Dragsbaek · Accepted Answer · 2011-11-23 12:32:21Z

1

You are building it the wrong way. You should never use curly brackets (or any other string) in a SQL query. Concatenate your query instead.

Like this:

$query_1=$field_name[0]."='".$field_value[0]."'";

and oh, you missed a $ before your query, thats why its null.

answered Nov 23, 2011 at 12:32

Jan Dragsbaek

8,1212 gold badges28 silver badges46 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Sudhir Bastakoti · Accepted Answer · 2011-11-23 12:34:08Z

1

This works for me:

$field_name[0] = "test";
$field_value[0] = "someting";
$query_1=$field_name[0]."='".$field_value[0]."'";
echo ("SELECT * FROM wines WHERE $query_1") or die(mysql_error());

Hope it helps

answered Nov 23, 2011 at 12:34

Sudhir Bastakoti

100k15 gold badges163 silver badges169 bronze badges

Collectives™ on Stack Overflow

building a sql query string with php parameters

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related