Question

Why do this..

$fruit_type = "banana";
mysql_real_escape_string($fruit_type);

$query = "SELECT * FROM posts WHERE fruit = " . $fruit_type . ";    

when you can do this..

$fruit_type = "banana";
mysql_real_escape_string($fruit_type);

$query = "SELECT * FROM posts WHERE fruit = $fruit_type;

I know that integers should be encapsulated in single quotes but is it fine to add a variable that contains a string directly?

Answer 1

Adding a string directly, without quotes (and escaped quotes within the value) will not work if that is your question.

The following will work with integers, provided you are matching on an number field, but it will not work with strings:

$query = "SELECT * FROM posts WHERE fruit = $fruit_type";

To match strings, you must enclose them within single quotes, and escape single quotes occurring within the value. The following will not escape quotes contained within the passed variable:

$query = "SELECT * FROM posts WHERE fruit = '$fruit_type'";

At the very least, you should do this:

$query = "SELECT * FROM posts WHERE fruit = " . mysql_real_escape_string($fruit_type); 

And at the first opportunity, read about these:

http://php.net/manual/en/pdo.prepared-statements.php