Question

I have a select statement working as shown below

$test = $pdo->query('Select col1, SUM(col2), SUM(col3), SUM(col3)*SUM(col2) from table group by col1');

I now want to multiply the sum of col2 so I have this line working

$test = $pdo->query('Select col1, SUM(col2)*100, SUM(col3), SUM(col3)*SUM(col2) from table group by col1');

However I want the user to be able to define the number in a form. I have the form working and I have created a variable as shown below.

$custom = ($_POST['custom']);

But when I try and put $custom into my select statement I get an error. I have tried a few different things here but can’t seem to get the result. I thought something similar to the below might work but it doesn’t? What is the best way to handle this?

$test = $pdo->query('Select col1, SUM(col2)*'$custom', SUM(col3), SUM(col3)*SUM(col2) from table group by col1');

Answer 1

Your best bet is using a prepared statement to pass the parameter in. However, you can’t use prepared statement parameters in column lists, so you’ll have to quote the value in instead.

$test = $pdo->query('
    Select 
        col1, 
        SUM(col2)*' . $pdo -> quote ($_POST ['custom']) . ', 
        SUM(col3), 
        SUM(col3)*SUM(col2) 
    from table 
    group by col1');

You’ll have to also make sure that $_POST is numeric, because if it’s blank or something you can’t multiply by then the query will still fail. You can do that like this.

$custom = $_POST ['custom'] * 1;
$test = $pdo->query('
    Select 
        col1, 
        SUM(col2)*' . $pdo -> quote ($custom) . ', 
        SUM(col3), 
        SUM(col3)*SUM(col2) 
    from table 
    group by col1');