Question

Suppose I have a query

SELECT * FROM table WHERE x > y;

where “y” is a user-input value. I’d like to enclose y in quotes. So far as I’ve tested, the query works properly when the quotes are added. Is the behaviour defined? Is it known to result in an efficiency drop?

Note that the query is an example fabricated for simplicity. Also, this is not an attempt to deal with SQL injection.

Answer 1

If the field that you are trying to compare with is a numeric field ie int, then all the possible combinations must work in mysql

select * from users where id = 20;

select * from users where id = "20";

select * from users where id = '20';

Refer the MySQL DOC for more depth