Question

If I have a table named book

Column 1 = current_user
, Column 2 = page_length
, Column 3 = author
, Column 4 = title

I’d like to select the data from columns 2, 3 and 4 that correspond to the currently logged in user. Is the following correct syntax?

<?
global $user;
$user_id=$user->name;
db_query('SELECT * FROM {book} WHERE current_user=$user_id', $page_length, $author,   $title); ?>

Answer 1

Some tips:

1. You need to make sure to use quotation marks around the string that is the SQL statement.
2. Since the username is a user-supplied string, you should use parameter escaping to prevent SQL injections.
3. You don’t really need to assign the user name to a separate variable ($user_id) to use it.
4. You need to retrieve your result from the return value of db_query.

Fixed code:

<?php
global $user;
$res = db_query("SELECT page_length, author, title FROM {book} WHERE current_user = '%s'", $user->name); 
$row = db_fetch_array($res);
// now $row['page_length'], $row['author'] and $row['title'] are filled in with values if the query was successful
?>