CODEWITHSUNDEEP
mysqlquotes
epsilones
epsilones

Reputation: 11609

Using simple and double quotes in an sql query

I have some issue with a sql query using quotes with variables. (In general I use "bind" so I don't have this kind of problem). Here's the query :

$myquery = mysql_query("SELECT * FROM mytable ORDER BY id ASC WHERE var='".$var."'");

The syntax seems not to be correct, can anybody help ?

Upvotes: 0

Views: 920

Answers (3)

Jim Dennis
Jim Dennis

Reputation: 17500

In general you should use the parameter binding features provided by your DBD (Database Driver for Perl) or other language and driver combination. I gather that you're using PHP (though you should tag your questions accordingly to remove the ambiguity.

Here's a StackOverflow thread on How to bind SQL parameters in PHP (using PDO). Note there are limitations to the PHP PDO::bindParam method as compared to similar features in other languages. So read the linked thread for caveats.

Here's another discussion about Binding Parameters to Statements ... for Perl (but conceptually applicable to other programming languages and their SQL libraries/drivers).

Upvotes: 1

alan978
alan978

Reputation: 555

well you can try something like this:

$query = sprintf("SELECT * FROM mytable WHERE var='%s' ORDER BY id ASC",mysql_real_escape_string($var));
$result = mysql_query($query) or die("Error:" . mysql_error());

Also note that ORDER BY is at wrong place. It is more readable and you don't need to bother with single qoute concating. Also it is safe for mysql injection. Hope this helps!

Upvotes: 2

Miqdad Ali
Miqdad Ali

Reputation: 6147

You can use it like

$myquery = mysql_query("SELECT * FROM mytable ORDER BY id ASC WHERE var='$var'");

Upvotes: -1

Related Questions