Unknown column 'x' in 'where clause'

pinkmink

Hi guys, newbie alert in desperate need of help!

I'm trying to get a PHP script to check that a few fields entered by a user matches against the details in the database.

All is well when the field Grid is set to an INT in the database (the script executes and moves on to the next stage), but I want the user to be able to enter a VARCHAR (or CHAR) for this value as it relates to a grid reference…for instance I want them to enter A4.

When I change the database to store this field as a VARCHAR I get the message Unknown column 'A4' in 'where clause' when execute the script.

Does anybody have any ideas what I need to change?

Here's the query -

$query_Recordset1 = "SELECT * FROM tblclients

WHERE UniqueID = " . $_POST['uniqueid'] .

" AND Grid = " . $_POST['gridref'] .

" AND Question1 = " . $_POST['questionone'] .

" AND Question2 = " . $_POST['questiontwo'] .

" AND Question3 = " . $_POST['questionthree'] ;

Thanks for you help!

dagon

while integers don't need to be quoted in a query, strings do. Also directly populating the db from the form with out any any sanitation is asking for trouble.

pinkmink

Hi Dagon, thanks for your response. Apologies for my newbie-ness, but whereabouts would I place the quotes to make this query work?

Thanks!

dagon

around

$_POST['gridref']

pinkmink

Hmm....when I try that I get a syntax error.

dagon

what error? what did you try?

pinkmink

I just took the original query -

$query_Recordset1 = "SELECT * FROM tblclients
WHERE UniqueID = " . $POST['uniqueid'] .
" AND Grid = " . $POST['gridref'] .
" AND Question1 = " . $POST['questionone'] .
" AND Question2 = " . $POST['questiontwo'] .
" AND Question3 = " . $_POST['questionthree'] ;

and put the quote marks around gridref -

$query_Recordset1 = "SELECT * FROM tblclients
WHERE UniqueID = " . $POST['uniqueid'] .
" AND Grid = " . "$POST['gridref'] ".
" AND Question1 = " . $POST['questionone'] .
" AND Question2 = " . $POST['questiontwo'] .
" AND Question3 = " . $_POST['questionthree'] ;

I take it I'm being very dim...! :queasy:

pinkmink

I have officially gone mental looking at this piece of code! I know it's only going to be an extra quote here and there, but it's driving me nuts!