Question

I have some issue with a sql query using quotes with variables. (In general I use “bind” so I don’t have this kind of problem). Here’s the query :

$myquery = mysql_query("SELECT * FROM mytable ORDER BY id ASC WHERE var='".$var."'");

The syntax seems not to be correct, can anybody help ?

Answer 1

well you can try something like this:

$query = sprintf("SELECT * FROM mytable WHERE var='%s' ORDER BY id ASC",mysql_real_escape_string($var));
$result = mysql_query($query) or die("Error:" . mysql_error());

Also note that ORDER BY is at wrong place.
It is more readable and you don’t need to bother with single qoute concating.
Also it is safe for mysql injection.
Hope this helps!