CODEWITHSUNDEEP
phppostgresqlpg-query
Spatial Digger
Spatial Digger

Reputation: 1993

Php postgresql variables in a query

I'm trying to get the right syntax for the following. In this case $post_pub = 1

$sql='SELECT "Publications"."Pub_ID", "Publications"."ART_TITEL" FROM "Publications" where "Pub_ID"="$post_pub"';

Php throws an error: column "$post_pub" does not exist

I've stumbled across pg_query_params, this feels like the right direction, but I need some help. How can I get this to work?

Upvotes: 0

Views: 1065

Answers (2)

Vao Tsun
Vao Tsun

Reputation: 51446

the problem is double quotes around variable. Postgres understands it as "database object" name, in this part of query, a column. to avoid it, try using:

$sql='SELECT "Publications"."Pub_ID", "Publications"."ART_TITEL" FROM "Publications" where "Pub_ID"='."$post_pub";

also consider moving to PDO - such usage is a straight invitation for sql injection. Setting$post_pub to 0 or (delete from Publications)" will delete all data if user has enough right, for example.

Upvotes: 0

Oto Shavadze
Oto Shavadze

Reputation: 42753

I never used pg_connect though I think you need something like this:

$sql='SELECT "Publications"."Pub_ID", "Publications"."ART_TITEL" 
FROM "Publications" 
where "Pub_ID"=$1 ';


$result = pg_query_params($dbconn, $sql, array($post_pub));

Upvotes: 3

Related Questions