CODEWITHSUNDEEP
phpmysqlsql
fguru
fguru

Reputation: 71

PHP integer value in SQL query

Here $id is integer value and it's not deleting from MySQL:

$Query="DELETE FROM table WHERE id='.$id.' and cid='".$cid."'";

Upvotes: 0

Views: 255

Answers (2)

Alex Shesterov
Alex Shesterov

Reputation: 27525

Your problem in short: you have mixed different quotation marks - " and '.

This problem would not arise if you would use prepared statements, as you would have had a single string literal:

$Query="DELETE FROM table WHERE id=? and cid=?";

This would also remove the possibility of SQL injections.

This would also speed-up you program if you need to execute the same prepared statement several times (the statement is already prepared and does not need to be parsed on the second+ invocation).

And finally, in case you are still using the officially deprecated PHP mysql extension you MUST switch to mysqli and use its full benefits like prepared statements. The mysql extension is no longer officially supported and may be removed in future (though I foresee that it will be moved to PEAR or so).

As a temporary solution, use mysql_real_escape_string to encode all variables which are derived from the user input. Please do NOT use mysql_escape_string as it is highly vulnerable to character encoding!

Upvotes: 3

What have you tried
What have you tried

Reputation: 11138

You forgot to close your "

The Solution:

$id = mysql_real_scape_string($id);
$cid = mysql_real_scape_string($cid);

$Query="DELETE FROM table WHERE id='".$id."' and cid='".$cid."'";

The Problem

So, if you were to echo out your statement as it was, the result would look like:

DELETE FROM table WHERE id='.1.' and cid='2'

See the problem with that?

Upvotes: 1

Related Questions