Error, Can't determine what is wrong...

[AdamD]

I have this simple code to extract some information from the user that is logged in.

$query = mysql_query("SELECT username, website, email FROM user WHERE username = $_SESSION['username']");

... and I keep receiving this error...

Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in /home/a6551599/public_html/account.php on line 24

... so if anyone could help, it would be much appreciated!

[bradgrafelman]

Remove the quotes from the array index inside the string, add curly braces around the variable ("complex syntax"), or use concatenation. See the Variable parsing section of the PHP manual.

EDIT: Additionally, some other issues:

1. All string values in SQL queries must be surrounded with single quotes.

2. Is $_SESSION['username'] guaranteed not to contain any characters which might break the query? If not, it should be sanitized.

3. It seems a bit silly to SELECT the "username" column when you already know the value contained in it.

[sneakyimp]

by 'sanitized,' bradgrafelman means you should probably use [man]mysql_real_escape_string[/man] on $SESSION['username'] before you stick it in a query:

$sql = "SELECT username, website, email FROM user WHERE username = '" . mysql_real_escape_string($_SESSION['username']) . "'";
$query = mysql_query();

Also, mysql_ functions have been deprecated and will go away before too long. You should use [man]mysqli[/man] instead.