using a variable in a mysqli_query? - php

Question

I am trying to return a value from my database based on a user input on my form.
When I run the code using a value it works but when I put in the variable it doesn't. I am sure it is something simple, but I just don't get it?
Here is the code that works:
$sql_beam = mysqli_query($link,"SELECT cost_ft FROM Beams WHERE number = '201'");
while($row = mysqli_fetch_array($sql_beam))
{
echo "<p>" . $row['cost_ft'] . "</p>";
echo "<br>";
}
When I change it to this it doesn't:
$beam_num = $_POST['Beam Number'];
$sql_beam = mysqli_query($link,"SELECT cost_ft FROM Beams WHERE number = '$beam_num'");
while($row = mysqli_fetch_array($sql_beam))
{
echo "<p>" . $row['cost_ft'] . "</p>";
echo "<br>";
}

Answer 1

You should never put any variable directly into a query. Google sql injection and how to prevent it.
Here is a simple example:
$sql = "SELECT cost_ft FROM Beams WHERE number = ?";
$stmt = $link->prepare($sql);
$stmt->bind_param("s", $beam_num);
$stmt->execute();
$result = $stmt->get_result();
while($row = $result->fetch_assoc())
{
echo "<p>" . $row['cost_ft'] . "</p>";
echo "<br>";
}

Answer 2

Variables in a query work best when enclosed in curly brackets like this:
$beam_num = $_POST['Beam Number'];
$sql_beam = mysqli_query($link,"SELECT cost_ft FROM Beams WHERE number = '{$beam_num}'");
while($row = mysqli_fetch_array($sql_beam))
{
echo "<p>" . $row['cost_ft'] . "</p>";
echo "<br>";
}
That should solve the problem, if it doesnt then try this:
$sql_beam = mysqli_query($link,"SELECT cost_ft FROM Beams WHERE number = $beam_num");
I had that in one of my codes and it worked.

Answer 3

Change your second line to this:
$sql_beam = mysqli_query($link,"SELECT cost_ft FROM Beams WHERE number = '". $beam_num ."'");