Error in SQL Select Where statement

Question

Got myself the following error and I can't seem to figure out why:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's-Gravenmoer'' at line 1

This is the SQL syntax:

$plaats = $row['plaats'];    

$query10 = "SELECT * FROM gebieden WHERE plaats = '$plaats'";

For those interested, the variable has this content: 's-Gravenmoer

Why is it giving me an error? Thanks!

this kind of db operaction is disaster... var_dump($query10); output is? — Glavić
– Glavić, Commented Sep 10, 2012 at 8:16

Florian Bauer · Accepted Answer · 2012-09-10 08:20:59Z

2

Use mysql_real_escape_string or htmlspecialchars

$plaats = $row['plaats'];    

$query10 = "SELECT * FROM gebieden WHERE plaats = '".mysql_real_escape_string($plaats)."';";

answered Sep 10, 2012 at 8:20

Florian Bauer

6373 silver badges12 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

John Woo · Accepted Answer · 2012-09-10 08:17:35Z

2

It's because the value of $plaats contains single quote.

You're code is prone to SQL Injection. Use PDO or MYSQLI

Example of using PDO extension:

<?php
    $stmt = $dbh->prepare("SELECT * FROM gebieden WHERE plaats = ?");
    $stmt->bindParam(1, $plaats);
    if ($stmt->execute()) 
    {
      while ($row = $stmt->fetch()) 
      {
        print_r($row);
      }
    }
?>

this will allow you to search records with single quotes.

answered Sep 10, 2012 at 8:17

John Woo

265k70 gold badges509 silver badges500 bronze badges

3 Comments

user1555076 Over a year ago

Well, my code isn't at risk for SQL injection, because the user can only input something in this table with a selection box, they cannot enter a string or anything... That said, thanks for you code, gonna test it right away!

John Woo Over a year ago

@user1555076 if that's the case use alternative mysql_real_escape_string($plaats)

Marcin Orlowski Over a year ago

@user1555076 if you do that, then it's fine.

Collectives™ on Stack Overflow

Error in SQL Select Where statement

2 Answers 2

Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related