T_STRING error - Trying to use PHP array in SQL where statement

Question

I feel like I'm making a rookie error here somewhere but can't figure out what's going wrong. I am using PHP and mySQL. I have an array $users that stores a current user's information. The array is storing the customer id (cid, its an integer). So I'm trying to pull information that is only tagged to a specific customer. My code is:

try
{
    $sql = 'SELECT id, title, image_url FROM shelf WHERE cid = $user['cid']'; 
    $result = $pdo->query($sql);
}

I feel like I have similar code in other parts of my program that are working so this seems like I may be doing something wrong in terms of syntax. If I replace $user['cid'] in the request with a hard-coded number like 22, the statement works fine. However, I need to pull the integer from $user. I'm getting a T_STRING error on the SELECT statement line. I have also tried to add an additional set of single quotes around $user['cid'] but that's not working either (i.e. $user['cid'])

Thanks for your help.

Twine

Try using double quotes instead of single quotes to assign your string — andrewsi
– andrewsi, Commented Sep 25, 2012 at 14:18

tadman · Accepted Answer · 2012-09-25 14:22:23Z

2

You're using PDO, so you should be using place-holders, too:

$stmt = $pdo->prepare('SELECT id, title, image_url FROM shelf WHERE cid=:cid');
$stmt->bindParam(':cid', $user['cid']);
$stmt->execute();

This ensures your data is escaped correctly and handles conversion to the appropriate database format where required.

answered Sep 25, 2012 at 14:22

tadman

212k23 gold badges237 silver badges266 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

tadman Over a year ago

Needle in a haystack some days, I swear. Thanks for the props.

OrangeTwine Over a year ago

Tadman, you nailed it. I had previously tried using placeholders and it still wasn't working. I had added in a $result = $r->fetch(); afterwards. I excluded it based on your advice and its working now.

Fad Over a year ago

@OrangeTwine if his answer solved your problem, make sure you click on the check mark to accept this as an answer.

tadman Over a year ago

Stick with placeholders. They'll serve you well.

Maciej Sz · Accepted Answer · 2012-09-25 14:19:34Z

2

Yup, rookie error. Change to double quotes and add { } around value like:

$sql = "SELECT id, title, image_url FROM shelf WHERE cid = {$user['cid']}";

answered Sep 25, 2012 at 14:19

Maciej Sz

12.1k9 gold badges43 silver badges58 bronze badges

6 Comments

Maciej Sz Over a year ago

How do you know if it's not escaped earlier?

tadman Over a year ago

If it's not obvious it's escaped, you cannot presume it's escaped.

Maciej Sz Over a year ago

The query string is obviously not a place to escape query value. Good luck applying set of filters while concating a string.

tadman Over a year ago

The query string is the ONLY place to escape a value. Period. This is not up for debate. If you're using string interpolation to insert values in your queries in PDO you are doing it wrong.

Maciej Sz Over a year ago

If it's the only place, so how come your example escapes it somewhere else? The escape is done by bindParam method, not in the query string. But I wont argue about details and I admit, in case of PDO your example is the right way to go, but the question was how to get rid of T_STRING error.

|

Bogdan Burym · Accepted Answer · 2012-09-25 14:21:19Z

-2

$sql = 'SELECT id, title, image_url FROM shelf WHERE cid = '.intval($user['cid']);

answered Sep 25, 2012 at 14:21

Bogdan Burym

5,5022 gold badges30 silver badges47 bronze badges

6 Comments

Matt Over a year ago

I'd slightly prefer (int) $user['cid'] over intval

Bogdan Burym Over a year ago

Author says "However, I need to pull the integer from $user". I give the way how to do it and get -1. Very nice. Thanks.

tadman Over a year ago

intval is not a substitute for proper SQL escaping. If you do this on a regular basis you're creating a whole world of hurt for yourself.

Matt Over a year ago

What's wrong with using (int) or intval for protecting integers in queries?

Bogdan Burym Over a year ago

If you mean the way it's written, I agree. I prefer using placeholders. But in current context what I wrote seems to be a nice way to fix the bug and find out what's going on + prevent injection of course. Please tell if intval or (int) work wrong, it would be very interesting for me at least.

|

Collectives™ on Stack Overflow

T_STRING error - Trying to use PHP array in SQL where statement

3 Answers 3

4 Comments

6 Comments

6 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

4 Comments

6 Comments

6 Comments

Your Answer

Sign up or log in

Post as a guest

Related