MySQL查询权限语法

Question

$query = mysqli_query($link, "SELECT *
    FROM table
    WHERE column=" . row_data['column'] . " ") or die(mysqli_error($link));

Can someone tell me what wrong with syntax? I honestly work on this problem in an hour but I can't figure it out up to now. I think it is on the syntax maybe my quoutes is placed on wrong?

row_data['column'] is equals to value a

If I make it hardcoded, it output expect results.

$query = mysqli_query($link, "SELECT *
    FROM table
    WHERE column='value a'") or die(mysqli_error($link));

Error

Unknown column 'value a' in 'where clause'

Answer 1

You just miss single quotes:

$query = mysqli_query($link, "SELECT *
    FROM table
    WHERE column='" . row_data['column'] . "' ") or die(mysqli_error($link));

In your second example you have placed single quotes around the value while in the first not.

I guess your data is coming from another query, so you can think about join to reduce number of queries.

If data is coming from a user input you should have a look at prepared statements. If you place user input directly into the query you are open to sql injections.

Last but not least if you are still learning have a look at pdo instead of mysqli