Re: question about passing field name in sql statement as variable.
- From: Andy Hassall <andy@xxxxxxxxxxx>
- Date: Wed, 30 Aug 2006 22:35:41 +0100
On 30 Aug 2006 14:14:27 -0700, "nephish" <nephish@xxxxxxxxx> wrote:
can anyone tell me if this is legal php/mysql ?
Did you try running it?
i am trying to write a simple function to get a single stat from a
single table.
$field = 'phone_number';
$customer = 'fred';
$query = mysql_query("SELECT `'{$field}'` FROM `customers` WHERE `name`
= '{$fred}' ");
// note the back quotes around $field
The single quotes inside the back quotes will break it.
or is this an accident waiting to happen ?
Probably, yes; depends where the data from the $field and $customer variables
comes from.
--
Andy Hassall :: andy@xxxxxxxxxxx :: http://www.andyh.co.uk
http://www.andyhsoftware.co.uk/space :: disk and FTP usage analysis tool
.
- Follow-Ups:
- References:
- Prev by Date: question about passing field name in sql statement as variable.
- Next by Date: Re: Need php help? Check http://phphelp.woohoow.net
- Previous by thread: question about passing field name in sql statement as variable.
- Next by thread: Re: question about passing field name in sql statement as variable.
- Index(es):
Relevant Pages
|
