[RESOLVED] Passing a variable to a SELECT statement

[dcjones]

Hi All.

Can anyone see why this should not work.

This works

mysql_select_db($database_pin, $pin);
$query = "SELECT clientID, f_company_name, month(f_date), COUNT(f_bag) as ct FROM found WHERE clientID = 'SOU'  GROUP BY MONTH (f_date) "; 

If I add a variable to catch the content of a SESSION var and echo it to the browser, $clid it has the expected content of "SOU"

This does not

$clid = $_SESSION['code'];

mysql_select_db($database_pin, $pin);
$query = "SELECT clientID, f_company_name, month(f_date), COUNT(f_bag) as ct FROM found WHERE clientID = " . $clid . "  GROUP BY MONTH (f_date) "; 

[halojoy]

do you use session_start() ?

[man]session_start[/man]

rsgars 🙂

[dcjones]

Hi and thansk for your reply.

Yes right at the top of the script:

<?php
session_start();

This one is a puzzle!

[Jack_McSlay]

there are no single quotes on the resulting string, therefore the where clause becomes invalid. do this:

$query = "SELECT clientID, f_company_name, month(f_date), COUNT(f_bag) as ct FROM found WHERE clientID = '" . $clid . "'  GROUP BY MONTH (f_date) "; 

[laserlight]

Also, even though $clid may come from a session variable, you still need to use [man]mysql_real_escape_string/man if you are using it as a string.

Incidentally, you may want to consider using the MySQLi extension or the PDO extension instead of the legacy MySQL extension.

[dcjones]

Hi all,

Many thanks

Resolved