I am wondering about the safe or correct way to pass a $variable to a query. I am new to PHP thats why I am asking such beginner question. Here is the example one and two, which one is correct and safer because of symbols?  Example one:  //here is the line I am asking about. The $identification $query = "SELECT * FROM `members` WHERE `username` = '$identification' LIMIT 1";   Example two:  //here is the line I am asking about. The $identification $query = "SELECT * FROM `members` WHERE `username` = '" . $identification . "' LIMIT 1";   I don't need answers about PHP 4 or 5 or PDO. I just need to know what is correct:  This   '" . $identification . "'   Or this  '$identification'
73
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
25759
I have encountered comparisions of variables to string literals multiple times over the years which had one character prefixing the variable and the literal, e.g.  if [ "x$A" = "xtrue" ]; then   in order to check whether $A is "true".  I assume this is done to achieve shell compatibility or to work around a longterm bug, an unintuitive behavior, etc. Nothing obvious comes to mind.  Today I figured I want to know the reason, but my research didn't turn up anything. Or maybe it's just me making something out of a rather frequent exposure to rare occurances.  Is this practice still useful, maybe even best?
13909
When encoding a query string to be sent to a web server - when do you use escape() and when do you use encodeURI() or encodeURIComponent():  Use escape:  escape("% +&amp;=");   OR  use encodeURI() / encodeURIComponent()  encodeURI("http://www.google.com?var1=value1&amp;var2=value2");  encodeURIComponent("var1=value1&amp;var2=value2");
40116
I am trying to understand when and why I should use the global $post variable. I have tried to do the following on a post page, outside the loop, and as expected it works.      &lt;?php          global $post;         echo $post-&gt;ID;     ?&gt;   If I do the same on an archive page (just wanted to see what happens), for some reason it also works, retrieving the ID of the previous post, even if I deleted the code above from the previous post page.  Is this like some kind of caching? How does this work exactly?  I understand global $post can be useful if I'm working on a fuction in functions.php. Is this the only use case?  Many thanks
41167
I am told that good developers can spot/utilize the difference between Null and False and 0 and all the other good "nothing" entities. What is the difference, specifically in PHP?  Does it have something to do with ===?
75001
As the topic suggests I wish to be able to pass table names as parameters using .NET (doesn't matter which language really) and SQL Server.  I know how to do this for values, e.g. command.Parameters.AddWithValue("whatever", whatever) using @whatever in the query to denote the parameter. The thing is I am in a situation where I wish to be able to do this with other parts of the query such as column and table names.  This is not an ideal situation but it's one I have to use, it's not really prone to SQL injection as only someone using the code can set these table names and not the end-user. It is messy however.  So, is what I am asking possible?   EDIT: To make the point about SQL injection clear, the table names are only passed in by source code, depending on the situation. It is the developer who specifies this. The developer will have access to the database layer anyway, so the reason I am asking is not so much for security but just to make the code cleaner.
110595
I am trying to save multiple values from a textarea to a database table.  I use the following code, but I feel it is the wrong way.   foreach ($user_emails as $key =&gt; $value) {   $insert_banned_emails = db_insert('banned_users');   $insert_banned_emails     -&gt;fields(array(       'email' =&gt; $value,     ))     -&gt;execute(); }   Is there a different way for achieving the same result?
48283
I am taking the Linux Essentials class and was doing well until I hit the scripting chapter. I simply do not understand these concepts.  Wondering if someone can break the following down into ultra simplistic terms or point me to a better reference to learn it. I'm currently using netacad's curriculum.        From the text book (with minor formatting changes):     There are some special variables in addition to the ones you set. You   can pass arguments to your script:  #!/bin/bash echo "Hello $1"       A dollar sign followed by a number N corresponds to the Nth argument   passed to the script. If you call the example above with ./test.sh the   output will be Hello Linux. The $0 variable contains the name of the   script itself.      After a program runs, be it a binary or a script, it returns an exit   code which is an integer between 0 and 255. You can test this through   the $? variable to see if the previous command completed successfully.     I understand how to assign variables and how they work with the $ but the whole issue with $0 and $1 -- I just don't get it.    Any help would be much appreciated.
17495
I have the following code:  $countQuery = "SELECT ARTICLE_NO FROM ? WHERE upper(ARTICLE_NAME) LIKE '% ? %'"; if ($numRecords = $con-&gt;prepare($countQuery)) {     $numRecords-&gt;bind_param("ss", $table, $brand);     $numRecords-&gt;execute();     $data = $con-&gt;query($countQuery) or die(print_r($con-&gt;error));     $rowcount = mysql_num_rows($data);     $rows = getRowsByArticleSearch($query, $table, $max);     $last = ceil($rowcount/$page_rows); }   Which should work fine. However I receive the error that :  You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '? WHERE upper(ARTICLE_NAME) LIKE '%?%'' at line 1  If I put  SELECT ARTICLE_NO FROM AUCTIONS WHERE upper(ARTICLE_NAME) LIKE '% o %';   The query works fine. $table is defined above, and query is received from GET, and both are correct valid values. Why is this failing?  edit: changing to:  $countQuery = "SELECT ARTICLE_NO FROM AUCTIONS1 WHERE upper(ARTICLE_NAME) LIKE '% ? %'";  if ($numRecords = $con-&gt;prepare($countQuery)) {      $numRecords-&gt;bind_param("s", $query);   results in the error:   Warning: mysqli_stmt::bind_param() [mysqli-stmt.bind-param]: Number of variables doesn't match number of parameters in prepared statement in C:\Program Files\EasyPHP 3.0\www\prog\get_records.php on line 38  Commands out of sync; you can't run this command now  where as   $countQuery = "SELECT ARTICLE_NO FROM AUCTIONS1 WHERE upper(ARTICLE_NAME) LIKE ?";  if ($numRecords = $con-&gt;prepare($countQuery)) {      $numRecords-&gt;bind_param("s", "%".$query."%");   results in  Fatal error: Cannot pass parameter 2 by reference in C:\Program Files\EasyPHP 3.0\www\prog\get_records.php on line 38  and lastly  $countQuery = "SELECT ARTICLE_NO FROM AUCTIONS1 WHERE upper(ARTICLE_NAME) LIKE ? ";  if ($numRecords = $con-&gt;prepare($countQuery)) {      $numRecords-&gt;bind_param("s", $query);   will give only:  Commands out of sync; you can't run this command now  Is it impossible to use a paramter for a LIKE statament?
721
I'm slowly moving all of my LAMP websites from mysql_ functions to PDO functions and I've hit my first brick wall.  I don't know how to loop through results with a parameter.  I am fine with the following:  foreach ($database-&gt;query("SELECT * FROM widgets") as $results) {    echo $results["widget_name"]; }   However if I want to do something like this:  foreach ($database-&gt;query("SELECT * FROM widgets WHERE something='something else'") as $results) {    echo $results["widget_name"]; }   Obviously the 'something else' will be dynamic.
30023
Why would someone use WHERE 1=1 AND &lt;conditions&gt; in a SQL clause (Either SQL obtained through concatenated strings, either view definition)  I've seen somewhere that this would be used to protect against SQL Injection, but it seems very weird.  If there is injection WHERE 1 = 1 AND injected OR 1=1 would have the same result as injected OR 1=1.  Later edit: What about the usage in a view definition?    Thank you for your answers.  Still, I don't understand why would someone use this construction for defining a view, or use it inside a stored procedure.  Take this for example:  CREATE VIEW vTest AS SELECT FROM Table WHERE 1=1 AND table.Field=Value
93053
(assume php5) consider  &lt;?php      $foo = 'some words';      //case 1     print "these are $foo";      //case 2     print "these are {$foo}";      //case 3     print 'these are ' . $foo; ?&gt;   Is there much of a difference between 1 and 2?  If not, what about between 1/2 and 3?
123088
I am writing a SQL query creator using some parameters. In Java, it's very easy to detect the last element of an array from inside the for loop by just checking the current array position with the array length.  for(int i=0; i&lt; arr.length;i++){      boolean isLastElem = i== (arr.length -1) ? true : false;         }   In PHP they have non-integer indexes to access arrays. So you must iterate over an array using a foreach loop. This becomes problematic when you need to take some decision (in my case to append or/and parameter while building query).   I am sure there must be some standard way of doing this.   How do you solve this in PHP?
99178
Consider I've set variable site and needs to be printed by echo or printf, but If I use single quote to write something and want to use variable then how?  Example:  $ site=unix.stackexchange.com $ echo "visit:$site" visit:unix.stackexchange.com   But If I use single quote:  $ echo 'visit:$site' visit:$site   Then we know that '' is strong quote and will not expand the variable   I've tried something:  $ echo 'visit:"$site"' visit:"$site"   but do not succeed. So, I am looking for way to print value inside variable while using single quote.
37436
I'm using  to check if a user-provided email address is valid. For example:  $email = $_POST['email']; if ( is_email( $email ) )     // Do something.   To the best of my knowledge, nothing in this function writes info to the database. Should I be sanitizing $email before I pass it to the function?
62599
Possible Duplicate:          I'm using the mysqli extension in PHP and I'm wondering, is there possibly any way to see a prepared query as it will be executed on the server, e.g. The query is something like this  select * from table1 where id = ? and name = ?   but I want to see the query after the values are filled in, like this:  select * from table1 where id = 20 and name = "John"
6195
Using PHP, what's the fastest way to convert a string like this: "123" to an integer?  Why is that particular method the fastest? What happens if it gets unexpected input, such as "hello" or an array?