Viewing Thread:
"Muh, PHP / MySQL"

I'm having a small issue with using the superglobals of PHP inside my MySQL queries. This :

$query = "SELECT customerPass FROM customers WHERE customerUsername = $_POST['username']";

Leads so jovially onto this :

Parse error: parse error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in /the/file/is_here/darktest.php on line 24

Thoughts? It works fine when I just use '$username'.

p/h

I usually find problems with echo "$_POST['var']";, I find the way to do it is echo "$_POST[username]";, or close your quotes and use dots.

AliBoy wrote:
> Beaten to it by Garin. :-)

Lol, ditto, but ideally you should have single quotes (') around a value on a WHERE expression in MySQL. Along with the correct string escaping etc, it stops people "modifying" your MySQL query.

phuzzy wrote:
> $query = "SELECT customerPass FROM customers WHERE
> customerUsername = $_POST['username']";

Try instead:

$query = "SELECT customerPass FROM customers WHERE customerUsername = '".$_POST['username']."';";

Beaten to it by Garin. :-)

$query = "SELECT customerPass FROM customers WHERE customerUsername = ${_POST['username']}";

or better

$query = "SELECT customerPass FROM customers WHERE customerUsername=".$_POST['username'];

Although you shouldn't throw GET/POST data into queries like that in the first place without validating it in some way.

DAMN! Those superglobals

I'm having a small issue with using the superglobals of PHP inside my MySQL queries. This :

$query = "SELECT customerPass FROM customers WHERE customerUsername = $_POST['username']";

Leads so jovially onto this :

Parse error: parse error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in /the/file/is_here/darktest.php on line 24

Thoughts? It works fine when I just use '$username'.

p/h