PHP Variable in MySQL Statement

[twelvetwelve]

When I use the following PHP code I get this error

Error performing query: Unknown column 'nh12134' in 'where clause'

Yet when I use 'nh12345', which is the Value that the variable $username contains (i've checked that it does by printing it out elsewhere) instead of the $username in the query it returns the correct value.

$tutorname = @mysql_query("SELECT Personal_tutor FROM Student WHERE student_ref=$username;"); 
if (!$tutorname) {
exit ('<p> Error performaing query: ' . mysql_error() . '</p>');
}

Any help is much appreciated

Thanks
NH

[pzuurveen]

someting like this:

$query = sprintf("SELECT Personal_tutor FROM Student WHERE student_ref='%s' ",
    mysql_real_escape_string( $username));

$tutorname = @mysql_query($query); 
if (!$tutorname) {
exit ('<p> Error performaing query: ' . mysql_error() . '</p>');
}

[ProfessorPC]

try this

$tutorname = mysql_query("SELECT Personal_tutor FROM Student WHERE student_ref = '".$username."'");

[Peterpan71]

$Search=$_POST['Search'];

$query_Retrieve = "Select Model,Prime_kVA,Prime_kW,Engine, Alternator,Cylinders,Bore, Stroke,Governer,Type, Retail WHERE (`$Search` like '%{$_POST[Engine]}%') OR (`$Search` like '%{$_POST[Type]}%')";

The above code produces: Wrong results

I have checked that the values are passed correctly.

The idea is that on the refering page the client selects the field to use when doing the query. I have never used variable to indicate the table in the query. Can someone please help me with this.

[ProfessorPC]

so you want to display everything from this table depending on the users search criteria. you are allowing the user to specify what field to search through. so you will need to grab 2 var's from other page.

$col = $_POST['column'];
$search = $_POST['search'];
$query = mysql_query("Select Model,Prime_kVA,Prime_kW,Engine, Alternator,Cylinders,Bore, Stroke,Governer,Type, Retail WHERE ".$col." like '%".$search."%'") or die(mysql_error());
while($row = mysql_fetch_assoc($query)){
echo $row['Model']."";
echo $row['Prime_kVA']."";
//continue to display remainder of fields
}

this is assuming you have the column in the other page for the user to select. and the textfield for the user to place the search text.

[ProfessorPC]

sorry i changed the code lets try that again.

$Search=$_POST['Search'];

$query_Retrieve = "Select Model,Prime_kVA,Prime_kW,Engine, Alternator,Cylinders,Bore, Stroke,Governer,Type, Retail WHERE (`".$Search."` like '%".$_POST[Engine]."%') OR (`".$Search."` like '%".$_POST[Type]."%')";

[Peterpan71]

$query_Retrieve = "SELECT Model, Prime_kVA, Prime_kW, Engine, Alternator, Cylinders, Bore, Stroke, Governer, Type,Retail 
   
  
  FROM Import WHERE 
  ((`".$Search."` = '%".$_POST[Engine]."%') AND (`Prime_kVA` = '%".$_POST[Prime_kVA]."%'))
                  OR 
  (`".$Search."` = '%".$_POST[Prime_kVA]."%')
                   
  ";
  //OR (`Engine`like '%{$_POST[Engine]}%') OR (`Alternator`like '%{$_POST[Alternator]}%') OR 
  mysql_select_db($database_generators, $generators);
  $Table = mysql_query($query_Retrieve, $generators) or die(mysql_error());

When I use "like" instead of the "=" I get results, but if I make the Prime_kVA (10) the the results that comes back is 10, 100 etc. when using the "=" I get no results.

[kukie]

Hi
I am very new to PHP an MYSQL
I have almost the same problem,
how can I

$q=$_GET["q"];
$CMY=$get["CMY"];
...

$query=("INSERT INTO the_array($CMY, model)
VALUES('$q','dddd')");

[rajarajan07]

$tutorname = @mysql_query("SELECT Personal_tutor FROM Student WHERE student_ref='$username'"); 
if (!$tutorname)

[Ankit_Parmar]

Use Single Quotes for PHP Variables in mysql.

i.e. '$username'