PHP Query select one record

Question

I just started with PHP and I don't understand why this line won't work

$zoek = '2341 KG';
foreach ($pdo->query ("select * from blad1 where Postkode = $zoek" ) as $klant)

but this one does work perfect

foreach ($pdo->query ("select * from blad1 where Postkode = '2341 KG' " ) as $klant)

Why don't you bind the parameter properly?

Daniel W.
– Daniel W.

2014-06-23 15:44:16 +00:00
Commented Jun 23, 2014 at 15:44 — Daniel W.
– Daniel W., Commented Jun 23, 2014 at 15:44

meda · Accepted Answer · 2014-06-23 16:06:55Z

4

You should prepare that query.

$stmt = $pdo ->prepare("select * from blad1 where Postkode = ?" );
$stmt->execute(array($zoek)); 
$klant = $stmt->fetch();//no loop it's a single record!

edited Jun 23, 2014 at 16:06

answered Jun 23, 2014 at 15:41

meda

45.5k14 gold badges97 silver badges123 bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

Daniel W. Over a year ago

it's not an issue, just cleaner. +1 for binding :)

Richard de Ree Over a year ago

Thank you, this one works fine for me. I will lookup, how and why I should prepare this query

tadman Over a year ago

Can you remove the part about quoting entirely? The placeholder method is the only reasonable way to do this here. That first example is a SQL injection bug.

meda Over a year ago

@tadman I removed that part, it was just an attempt to answer as to why it didnt work. is that why im getting downvoted?

tadman Over a year ago

I flipped it after you fixed it. Thanks! Explanations are fine, but code that works and exposes people to serious risk is not a great way to start an answer.

|

Collectives™ on Stack Overflow

PHP Query select one record

1 Answer 1

8 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

8 Comments

Your Answer

Sign up or log in

Post as a guest

Related