Variable in select statement.

timstring

I have no idea what the proper syntax of this statement:

$Quest = "SELECT * FROM `$TableMonth` WHERE TechNum = '$TechNum' && WorkDate = '$IncDate'";
 					$result = mysql_query($Quest, $cxn)
						or die ('the bear went over the mountain  ' . mysql_error());

				while ($row = mysql_fetch_array($result))

						$WorkOrders = $row['TotalWorkOrders'];
						$CallCount = $row['CallCount'];

What should or should not be around $TableMonth?

tim

bradgrafelman

Uh... can you elaborate more? For example, you might start with... what's the problem?

Ashley_Sheridan

Typically you only need backticks around table and field names that might use a reserved keyword in MySQL. For example, it's common to have a field on a table called "order". As that's a reserved word, you would refer to that field as order.

Also, stop using the mysql functions. Every time you do, a developer is viciously mauled to death by killer kittens. Use the mysqli functions, or PDO instead.

Bonesnap

So many deaths. 🙁

NogDog

There should be no problem with back-ticks around the table name: while they are not always needed, it never hurts to have them. However, if by any chance $TableMonth includes the database name in a "dot" format, e.g. "database.table", then it would break, as it would need to be database.table. Additionally, any external values being used in a query should be escaped, e.g. with the mysql_real_escape_string() function in this case (uh-oh, is that a herd of vicious kittens I hear approaching?).

johanafm

NogDog;11021007 wrote:
There should be no problem with back-ticks around the table name: while they are not always needed, it never hurts to have them.

Is that still true for its standards comliant mode? Or was it ansi quotes mode?

Either way, I'd still recomend enabling standard quotes and using them. If you ever want to switch dbs, identifiers will be properly quoted to begin with. And string literals will also be guaranteed to be properly quoted.

NogDog

johanafm;11021221 wrote:
Is that still true for its standards comliant mode? Or was it ansi quotes mode?

Either way, I'd still recomend enabling standard quotes and using them. If you ever want to switch dbs, identifiers will be properly quoted to begin with. And string literals will also be guaranteed to be properly quoted.

According to the manual, if you enable ANSI_QUOTES, then you may use either back-ticks or double-quotes to quote identifiers, but then you can only use single quotes around string literals (which makes sense 😉 ).

(I've been almost exclusively using PostgreSQL/PDO for the past year, so I had to look that up. 🙂 )