PHP中的SQL SELECT语句

Question

Which one is correct?

Having trouble with single quotes vs double quotes in PHP and using Oracle 11g db...

<?php 
$query1  = oci_parse($conn, 'SELECT * FROM SCHEMA.TABLE_A WHERE B_ID=' . $id);
$query1  = oci_parse($conn, "SELECT * FROM SCHEMA.TABLE_A WHERE B_ID='" . $id . "'");
?>

Answer 1

If id is numeric, you should not quote the value. If it's a character string, you should.

Regardless, using string manipulation to create an SQL statement is usually a bad practice that leaves your application vulnerable to SQL injection attacks. Instead, you should use a prepared statement:

$query1 = oci_parse($conn, 'SELECT * FROM SCHEMA.TABLE_A WHERE B_ID=:id');
oci_bind_by_name($query1, ":id", $id);
oci_execute($query1);