php - wrong output in mysql_fetch_array -


here snippet of code :

    require_once('functions.php');     include('dbinfo.php');     connectdb();   $querys= "select 'score' solve (problem_id='".$_get['id']."' , username='".$_session['username']."')";             $resultscore=mysql_query($querys);             $scorefetch=mysql_fetch_array($resultscore);             $subractscore=$scorefetch['score']; echo $subractscore; 

ideally output should value stored in score field of database..but prints '

score

' .. wrong in this?also the query results 1 record @ time.

the reason why query won't work expected because wrapping column name single quotes. (column name , table name) identifiers , not string literals shouldn't wrap single quote.

select score solve where.... 

if happens column names and/or tables names used reserved keywords, can escape backticks not single quotes.

in case, backticks aren't required since none of them reserved keywords.


as sidenote, query vulnerable sql injection if value(s) of variables came outside. please take @ article below learn how prevent it. using preparedstatements can rid of using single quotes around values.


Comments

Popular posts from this blog

linux - xterm copying to CLIPBOARD using copy-selection causes automatic updating of CLIPBOARD upon mouse selection -

qt - Errors in generated MOC files for QT5 from cmake -