MySQL - Build a query string - php

Question

I've tried aLL of the below yet I can't seem to get it working
$sql="UPDATE filename SET weekday = {$_GET[wkd]} WHERE id = 2";
$sql="UPDATE filename SET weekday = '$_GET[wkd]' WHERE id = 2";
$sql="UPDATE filename SET weekday = '"{$_GET[wkd]}"' WHERE id = 2";
$sql="UPDATE filename SET weekday = '."{$_GET[wkd]}".' WHERE id = 2";
What is the correct way?
Thanks

Answer 1

The proper way? Assuming $link is your mysqli_connect
$wkd = mysqli_real_escape_string($link, $_GET['wkd']);
$sql = "UPDATE filename SET weekday = '" . $wkd . "' WHERE id = 2";
http://de1.php.net/manual/en/mysqli.real-escape-string.php

Answer 2

This:
$sql="UPDATE filename SET weekday = '" . $_GET['wkd'] . "' WHERE id = 2";
FYI, this is very bad coding practice, you should validate $_GET before add to sql.

Answer 3

Alright. If weekday accepts string values, then the value needs to be surrounded with quotes, ie:
$sql="UPDATE filename SET weekday = '" . $_GET['wkd'] . "' WHERE id = 2";
This is also equivalent to:
$sql="UPDATE filename SET weekday = '{$_GET['wkd']}' WHERE id = 2";
The first concatenates the string together, the second simply inserts the variable directly into the string.
For $_GET['wkd'] = "tuesday";, bot of those queries output this:
UPDATE filename SET weekday = 'tuesday' WHERE id = 2
If weekday only accepts numeric values, then there is no need to surround the value with quotes (but you still can):
$sql="UPDATE filename SET weekday = " . $_GET['wkd'] . " WHERE id = 2";
Which like the first, is equivalent to:
$sql="UPDATE filename SET weekday = {$_GET['wkd']} WHERE id = 2";
Which for $_GET['wkd'] = 1, will have both queries output:
UPDATE filename SET weekday = 1 WHERE id = 2
Point is - there is no one correct syntax, they'd all work.
However, what you really want to be doing is using pdo or mysqli with prepared statements and parameter binding, like so:
$pdo = new PDO('... connection string ... ');
$stmt = $pdo->prepare("UPDATE filename SET weekday = ? WHERE id = ?");
$stmt->execute(array($_GET['wkd'], 2));
This will bind the value of $_GET['wkd'] to the first ? in the prepared statement, and the literal 2 to the value of the second `?'. If you find yourself using lots of question marks, or losing track of the order, you can also use named placeholders like this:
$pdo = new PDO('... connection string ... ');
$stmt = $pdo->prepare("UPDATE filename SET weekday = :weekday WHERE id = :id");
$stmt->execute(array(
'weekday' => $_GET['wkd'],
'id' => 2
));
In that example i've named the placeholders the same as the fields - this isn't necessary but it is obviously more readable than naming the placeholders :asdfasdf and :lmnop (in which case the array being passed to the execute function would be ('asdfasdf' => $_GET['wkd'], 'id' => 2)
Why use the parameter binding? Its your best defense against SQL Injection