Question

I really can’t understand why this statement is wrong

$uname=$_POST['username'];
$pass=$_POST['pass'];
$str="select * from account where username='".$uname."' and password='".$pass."'";
echo $str;
echo "\n";
$str=mysql_real_escape_string($str);
$result=mysql_query($str) or die("Error: ". mysql_error(). " with query ". $str);
$num=mysql_num_rows($result);

It shows me:

select * from account where username='negin'and password='parsa' Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'negin\'and password=\'parsa\'' at line 1 with query select * from account where username=\'negin\'and password=\'parsa\'

Answer 1

Use mysql_real_escape_string() on the parameters, no on the whole query. You are escaping the single quotes so the query goes wrong.