将变量插入SELECT语句的正确语法是什么？

Question

I believe I have a simple syntax problem in my SQL statement. If I run this code, I get an error in the database query.

$user = $_GET['linevar'];
echo $user;  // testing - url variable echos correctly
$sql = "SELECT * FROM `userAccounts` WHERE `name` = $user";
$result = mysql_query($sql) or die("Error in db query");

If I replace $user in the $sql string with 'actualName' or a known record in my table, the code works fine. Am I using the $ variable incorrectly in the SQL string?

Answer 1

You need to surround the value that you're getting from $user with quotes, since it's probably not a number:

$sql = "SELECT * FROM `userAccounts` WHERE `name` = '$user'";

Just as a note, you should also read up on SQL injection, since this code is susceptible to it. A fix would be to pass it through mysql_real_escape_string() :

$user = mysql_real_escape_string( $_GET['linevar']);

You can also replace your or die(); logic with something a bit more informative to get an error message when something bad happens, like:

or die("Error in db query" . mysql_error());

Answer 2

这应该工作：

$sql = "SELECT * FROM `userAccounts` WHERE `name` = '" . $user . "'";

Answer 3

You need escape the get input, then quote it.

// this is important to prevent sql injection.
$user = mysql_real_escape_string($_GET['linevar']);

$sql = "SELECT * FROM `userAccounts` WHERE `name` = '$user'";