Question

I am coming across a problem when deleting data from my SQL data. I have tried various versions of my statement but to no avail. Below is the error I am presented with and the statement I am using.

$sql = "DELETE FROM `saved_holidays` WHERE (subscriberID= $user AND title= $check_value)";

//connect to database then execute the SQL statement.
$db->exec($sql);

and the error message is:

SQLSTATE[42000]: Syntax error or access violation: 1064 You have an
error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near '@xml119.com AND
title= Luxurious Jamaican holidays | 40% Discount On Accommodati' at
line 1

I can see that the correct data is being passed but the syntax is wrong. Can anyone help?

Answer 1

$check_value is a string, so you have to enclose it in ' in your query like this:

title = '$check_value'

For security purposes, you should also use mysql_real_escape_string on all string parameters you have. Or even better, use prepared statements: http://php.net/manual/en/pdo.prepared-statements.php