Use of undefined constants

[slightlyeskew]

Hey All. I'm trying to make a call to my db and then retrieve with fetchRow. I receive these errors :
Notice: Use of undefined constant Blah - assumed 'Blah' in /var/www/NovaDB/testvar.php on line 10

Notice: Use of undefined constant yada - assumed 'yada' in /var/www/NovaDB/testvar.php on line 10

Fatal error: Call to undefined method MDB2_Error::fetchRow() in /var/www/NovaDB/testvar.php on line 11

I've seen the undefined method error before and I believe it occurs when I try to search and use a WHERE clause that doesn't have a match in my db. I'm not too concerned about that one.

My code:

//assume error reporting and proper db connection

$first = Blah; $last = Yada;
//assume that the entry exists in the db
$getBlah = $db->query("SELECT ShareholderID FROM ShareholderNames WHERE First_Name = $first AND Last_Name = $last");
$row = $getBlah->fetchRow();

What do I need to do to make the query properly handle the strings? I don't have this error when I use, e.g. $first = $_POST['twiddle']
and then use $first in my query. As always, any help would be appreciated.

FYI, I tried defining a constant,

define ('first', 'Blah'); define ('last', 'Yada');

and then doing the query as described above however it still didn't work. Thanks for any help you can provide!

[johanafm]

Here's a PHP error:

$first = Blah; $last = Yada;

It should be

$first = 'Blah';	// single quote works fine
$last = "Yada";	// so does double quotes (although they do have a different meaning)

And here's a SQL error:

WHERE stringField = unquoted_string_literal;

which should be

WHERE stringField = 'singlequoted string literal';
-- do note that SQL does not accept " as string delimiter, only '

And always, without exception, check for errors before trying to use your result set

$getBlah = $db->query("SELECT ShareholderID FROM ShareholderNames WHERE First_Name = $first AND Last_Name = $last");
if (PEAR::isError($db)) {
	/* something went wrong. echo/error_log error and take other appropriate 
	actions as needed, possibly ending with die() or exit; */
}
else
	$row = $getBlah->fetchRow();

[bradgrafelman]

Also note that user-supplied data should never be placed directly into a SQL query. Instead, you must first sanitize it with the appropraite function (e.g. PEAR:😃B's escapeSimple() function) or use prepared statements.