CODEWITHSUNDEEP
phpmysql
kicsitiger
kicsitiger

Reputation: 37

MySql select quotation marks

I have the fallowing code :

$query = "SELECT `email` FROM `user` WHERE `email` = " . mysql_real_escape_string($this->email) . "";

I don't know what kind of quotation marks should i use, because it doesn't work.

Upvotes: 0

Views: 534

Answers (5)

DevZer0
DevZer0

Reputation: 13535

There are many ways to construct queries. You have chosen a raw approach which is legal, but the extension your using is marked depricated. I suggest looking into mysqli and PDO.

For your answer. 

$query = "SELECT `email` FROM `user` "
       . "WHERE `email` = '" . mysql_real_escape_string($this->email) . "'";

Upvotes: 0

Quentin
Quentin

Reputation: 944054

None, instead you should use a placeholder and then allow the database library / server to handle the escaping and quoting of your data (as described in How to prevent SQL injection in PHP?).

Upvotes: 1

Goutam Pal
Goutam Pal

Reputation: 1763

$query = "SELECT `email` FROM `user` WHERE `email` = " . mysql_real_escape_string($this->email) . "";

should be 

$query = "SELECT `email` FROM `user` WHERE `email` = '" . mysql_real_escape_string($this->email) . "'";

Upvotes: 0

GautamD31
GautamD31

Reputation: 28753

Try with single quotes('')

$query = "SELECT `email` FROM `user` WHERE `email` = '" . mysql_real_escape_string($this->email) . "'";

Upvotes: 0

user399666
user399666

Reputation: 19889

Single quotes should be used:

$query = "SELECT `email` FROM `user` WHERE `email` = '" . mysql_real_escape_string($this->email) . "'";

Upvotes: 2

Related Questions