query to MySQL

[Anon]

Im new to PHP and am trying to create a login system that works. But i keeping running into the problem with single and double quotes in my query.

When i try this

$query = "SELECT name, password FROM $table where name=/"$name/" and password=/"$password/"";

i get the "unexpected T_VARIABLE" error.

when i try this

$query = "SELECT name, password FROM $table where name='$name' and password='$password'";

the query goes to MySQL as this

$query = "SELECT name, password FROM $table where name='username' and password='password";

which obviously don't work cause the quotes around the password are incorrect.

Can someone please tell me how to properly quote the variables in my query.

Note: i even tried dividing the string up and putting them back together with "." but i can errors with that method too.

[Anon]

Um, for one thing you use \, not /.

For another, your second query should produce

SELECT name, password FROM mytable where name='username' and password='password'

With 'password' properly quoted.

[Anon]

better to use

"SELECT name, password FROM mytable where name='". $username . "' and password='" . $password ."' ";

assuming you have striped out tags and/or run a regex on username and password.

Even better

$sql = "SELECT name, password FROM mytable where name='". addslashes($username) . "'";

$results = mysql_query($sql)
then check if password is correct

Also look at mysql_escape_query