Question

Is it possible to use $_SESSION[var] in INSERT and SELECT statements of mysql as in below

$query = "INSERT INTO table1 (id, var1, var2)
            VALUES (NULL, '$_SESSION[var1]', '$_SESSION[var2]')";
mysql_query($query);
die(mysql_error()); 

NOTE: I have session_start(); at the start of all my pages.

Answer 1

Good idea to sanitize your vars before executing queries against them:

$var1 = mysql_real_escape_string($_SESSION['var1']);
$var2 = mysql_real_escape_string($_SESSION['var2']);

$query = 
    "INSERT INTO table1 (id, var1, var2) " .
    "VALUES (NULL, '" . $var1 . "', '" . $var2 . "')";

mysql_query($query) or die(mysql_error()); 

Note that your last time line of code die(mysql_error()) will cause the script to stop execution regardless of whether or not an error occured.

Also, you may want to look into PDO for your database interaction.