Question

I have just read the following code but do not understand why there is ” and also ‘ used. Thank you!

$sql='SELECT uid,name FROM users WHERE user="'.mysql_real_escape_string($_POST['login_name']).'" AND ..

Answer 1

This is a PHP program to write an SQL query (and store it in a string).

The target SQL looks like this:

SELECT uid,name FROM users WHERE user="something" AND …

So in PHP terms:

$foo = 'SELECT uid,name FROM users WHERE user="something" AND …'

But you want to replace “something” with dynamic data. In this case the posted login_name — but made safe for MySQL.

$foo = 'SELECT uid,name FROM users WHERE user="' .
       mysql_real_escape_string($_POST['login_name']) .
       '" AND …'

A better approach is to use prepared statements.