Variable mysql statement in php

Question

I have a variable that is a filter for my query:

$filterString.=" AND venue = ".$venue;

And I want this variable (when called) to add the AND filter statement to my query.

My query is as follows (with the failed attempt):

mysql_query("SELECT * FROM event 
WHERE city = '$city' " . $filterString . " 
ORDER BY date ASC");

Please don't do this (substitute user-suplied data directly into an SQL query). You're allowing an SQL injection attack. Instead use a "prepared statement" (data-binding of placeholders in the query). — David-SkyMesh
– David-SkyMesh, Commented Aug 31, 2013 at 3:55
@David-SkyMesh ... How do you know that $city and $venue are "user-suplied data" — Fabien TheSolution
– Fabien TheSolution, Commented Aug 31, 2013 at 4:38

Gordon Linoff · Accepted Answer · 2013-08-31 03:57:12Z

1

I think the venue needs to be surrounded by single quotes:

$filterString.=" AND venue = '".$venue.".";

However, it is better to use parameterized queries, instead of embedding queries directly in the SQL string.

answered Aug 31, 2013 at 3:57

Gordon Linoff

1.3m62 gold badges705 silver badges857 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

David-SkyMesh Over a year ago

You can bind an additional parameter that controls (logically) whether the AND statement has effect. e.g: ` where city = ? and ((not ?) or venue = ?))`

David-SkyMesh Over a year ago

it would be better if you showed @pedrum how to do the parameterised query, as well as the logical inclusion/exclusion of the filter.

pedrum golriz Over a year ago

Is there any way to have a WHERE something = Anything?

Stephen O'Flynn · Accepted Answer · 2013-08-31 06:06:23Z

0

You could use:

$filterString .= !empty($venue) ? " AND venue = '$venue'" : '';

Substitute whatever test you want at the start, the idea is to return a blank string if $venue doesn't apply to the filter.

To answer your other comment question:

WHERE 1

is a valid condition that works like Anything

answered Aug 31, 2013 at 6:06

Stephen O'Flynn

2,32923 silver badges34 bronze badges

Collectives™ on Stack Overflow

Variable mysql statement in php

2 Answers 2

3 Comments

Comments

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Related