Which syntax is correct from my code? - php

Question

I am using ajax to search from mysql database.
But I am getting error in query syntax saying error near where division=UNKNOWN.
what is correct syntax
code :
<?php
include('db.php');
if(isset($_POST['division'])){
$division=$database->filter($_POST['division']);
$check_user = array(
'division' => $division
);
$exists = $database->exists( 'tablename', 'division', $check_user );
if ($exists){
$sql2 = "select * from tablename where division = '".$division."' group by branch order by branch ASC";
$sql=$database->get_results($sql2);
echo '<option value="">--Select Branch--</option>';
foreach($sql as $row){
$name=$row['branch'];
echo '<option value="'.$name.'">'.$name.'</option>';
}
}
}
?>
Here Which is correct?
1)
$sql2 = "select * from tablename where division = '".$division."' group by branch order by branch ASC";
Or
2)
$sql2 = "select * from tablename where division = '$division' group by branch order by branch ASC";

Answer 1

As stated in many comments (Joshua Bakker / Saty / ADyson), you should really consider using PPS : Prepared Parameterized Statements. This will help Preventing SQL injection
This is a raw example of what you could use (please adapt to what you need) :
<?php
error_reporting(E_ALL); ini_set('display_errors', 1); /* let PHP help us */
$host = ""; /* your credentials here */
$user = ""; /* your credentials here */
$pwd = ""; /* your credentials here */
$db = ""; /* your credentials here */
/* store in PHP variable */
/* you may also want to perfom some other/more checking on this var */
/* NEVER trust user side data */
$division = $_POST['division'];
echo"[ division -> $division ]"; /* just checking value -> to be removed */
/* connexion to db */
$mysqli = mysqli_connect("$host", "$user", "$pwd", "$db");
if (mysqli_connect_errno()) { echo "Error: no connexion allowed : " . mysqli_connect_error($mysqli); }
/* make sure 'tablename' and 'branch' use below are correct -> adapt to your needs */
$query = " SELECT `branch` FROM `tablename` WHERE division=? GROUP BY `branch` ORDER BY `branch` ASC ";
$stmt = $mysqli->prepare($query); /* prepare query */
$stmt->bind_param("s", $division); /* bind param will sanitize :
here we make use of $var 'division' with 's' because it's a string AFAIK */
print_r($stmt->error_list); /* any error ? */
print_r($stmt->get_warnings()); /* any error ? */
print_r($stmt->error); /* any error ? */
$results = $stmt->execute();
$stmt->bind_result($branch); /* we use the result of the query */
$stmt->store_result();
if ($stmt->num_rows > 0) {
echo '<option value="">--Select Branch--</option>';
while($stmt->fetch()){
echo '<option value="'.$branch.'">'.$branch.'</option>';
}
}
else
{ echo"[ no data ]"; }
?>