how to pass String Datatype value from query string in php

Question

I have an issue passing string value using query string in PHP. I am using a PhpMyAdmin database.

Below is my query string :

http://192.168.0.106/PHP/webservice/comments.php?city_town='Vadodara'

and my php code is as below :

if(isset($_GET["city"])){
    @$city = $_GET["city"];

//echo $city;
$query = "select * from shop_detail where city_town ='". $city ."' ";

Looks like problem is you are getting "city" instead of "city_town" — Maxqueue
– Maxqueue, Commented Jun 3, 2015 at 13:20
1. PHP name differs from element. 2. You have quotes in the value being passed in. 3. You're open to SQL injections with this code, separate user input from query. 4. Don't use @. Don't suppress errors. — chris85
– chris85, Commented Jun 3, 2015 at 13:22

Saty · Accepted Answer · 2015-06-03 17:13:07Z

1

Use city_town not city And use mysqli_real_escape_string to prevent sql injection and also table and column name in backtick

if(isset($_GET["city_town"])){
    $city = mysqli_real_escape_string($conn,$_GET["city_town"]);

//echo $city;
$query = "select * from `shop_detail` where `city_town` ='". $city ."' ";

edited Jun 3, 2015 at 17:13

answered Jun 3, 2015 at 13:19

Saty

22.5k7 gold badges35 silver badges52 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

chris85 Over a year ago

The mysqli_real_escape_string requires the connection, no? Also it's not clear to me that the OP is using mysqli. I'd just point the OP to this thread for SQL injection prevention, stackoverflow.com/questions/60174/….

Collectives™ on Stack Overflow

how to pass String Datatype value from query string in php

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related