How to insert a php variable in an sql query? Mistake in my query?

Question

I wrote this simple code to delete a blog from the sql table. But its giving an error

Could not delete data: Unknown column '$qid' in 'where clause'

Cant understand why. $qid is the variable while just qid is the column name and its giving me this error.

<?php
$dbhost = 'localhost';
$dbuser = 'root';
$dbpass = '';
$conn = mysql_connect($dbhost, $dbuser, $dbpass);
mysql_select_db('trial1');
if(! $conn )
{
    die('Could not connect: ' . mysql_error());
}
function check_login(){
        return 12;
}
$return_array = array();
if( check_login()!=NULL){
    $qid =1;
    $sql='DELETE FROM blog_post WHERE qid = $qid';
    $retval = mysql_query($sql, $conn);
    if (!$retval){
        die('Could not delete data: ' . mysql_error());
        $return_array["success"] = 0; //If deletion unsuccessful
        echo json_encode($return_array);
    }
    else{
        $return_array["success"]=1; //If deletion successful 
        echo json_encode($return_array);
    }
}
 ?>

just try with $sql='DELETE FROM blog_post WHERE qid = "'.$qid.'"'; — Amila
– Amila, Commented Apr 18, 2014 at 4:10

Community · Accepted Answer · 2023-11-17 19:53:52Z

2

Variables will not be parsed under single quotes. Enclose the SQL query under double quotes ".

$sql="DELETE FROM `blog_post` WHERE `qid` = $qid"; //<-- Like this.

This (mysql_*) extension is deprecated as of PHP 5.5.0, and will be removed in the future. Instead, Prepared Statements of MySQLi or PDO_MySQL extension should be used to ward off SQL Injection attacks !

edited Nov 17, 2023 at 19:53

CommunityBot

11 silver badge

answered Apr 18, 2014 at 3:54

Shankar Narayana Damodaran

68.6k43 gold badges102 silver badges129 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

user3481478 Over a year ago

Thanx a lot. Working now. Never knew that this was important. Seems I always used double quotes and first time used single quotes and this happened :P

Shankar Narayana Damodaran Over a year ago

@user3481478, Glad its working , but please see the disclaimer. You need to switch to a new database API. Currently, you are using a deprecated API.

potashin · Accepted Answer · 2014-04-18 03:56:00Z

1

You should wrap your input in the sql with single quotes :

 $sql="DELETE FROM `blog_post` WHERE `qid` = '$qid'";

answered Apr 18, 2014 at 3:56

potashin

44.7k11 gold badges92 silver badges113 bronze badges

Comments

Amit K. · Accepted Answer · 2014-04-18 03:57:00Z

0

Very first you need to make sure you have a column name qid in table.

Then try:

$sql='DELETE FROM blog_post WHERE qid ='.$qid;

answered Apr 18, 2014 at 3:57

Amit K.

3,8126 gold badges30 silver badges45 bronze badges

Collectives™ on Stack Overflow

How to insert a php variable in an sql query? Mistake in my query?

3 Answers 3

2 Comments

Comments

Comments

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

Comments

Related