$_POST in SQL

[owaring]

just a quiky i hope,

can i put a $_POST['whatever'] in an SQL query??

what format do i need to put it in, or do i need to create a variable from it first??

[devinemke]

$sql = "SELECT * FROM table WHERE field = '" . $_POST['whatever'] . "'";

[owaring]

aha...........but hold the champagne!

thanks devinemke thats great,

but is there any reason why this shouldnt work?

$query = "SELECT * FROM crew WHERE '" . $_POST['field'] . "' = '" . $_POST['input'] . "' ";

I know SQL is fine because the following works

$query = "SELECT * FROM crew WHERE firstname = '" . $_POST['input'] . "' ";

FYI i'm testing the first query with $_POST set to "firstname"

[devinemke]

Originally posted by owaring
but is there any reason why this shouldnt work?

you don't want/need quotes around field names in an SQL query.

[owaring]

that'll be the wood behind the trees then!!

Cheers devinemke