Question

I have a DB table. I want to make a text input where the user can input the “uid” and the query will return the row associated with that uid.

So let’s say I have something like this:

$query = "SELECT name,age FROM people WHERE uid = '2' LIMIT 0,1";
$result = mysql_query($query);
$res = mysql_fetch_assoc($result);

echo $res["age"];

how would I modify that query to something like..

SELECT name, age 
  FROM people 
 WHERE uid = $_POST['blahblah'] LIMIT 0,1

Thanks in advance for your help!

Answer 1

To save from SQL injection attack, use:

$search_query = mysql_real_escape_string($_POST['blahblah']);

$query  = "SELECT name, age FROM people WHERE uid = '".$search_query."' LIMIT 0 , 1";