How to add contents of file to MySQL query inside php - php

Question

I'm using the following php query to install tables in my CMS system:
$q=new mysql("
INSERT INTO `adm` (`id`, `login`, `adm`, `passwd`, `czas`, `logged`, `ip`, `email`) VALUES
(0, 'admin', 1, PASSWORD('admin'), 0, 0, '0.0.0.0', 'admin#domain.com');
");
However instead of e-mail admin#domain.com I would like to use e-mail stored inside /settings/contact.inc.php file which is:
<?php
$emailaddress='admin#domain.com';
?>

Answer 1

Simply include the file and use the variable:
require_once("/settings/contact.inc.php");
$q=new mysql("
INSERT INTO `adm` (`id`, `login`, `adm`, `passwd`, `czas`, `logged`, `ip`, `email`) VALUES
(0, 'admin', 1, PASSWORD('admin'), 0, 0, '0.0.0.0', '$emailaddress');
");
Beware of SQL injection
In this case you know where $emailaddress, comes from and you can trust the content. In other cases you need to protect your code against SQL injection.
Therefore, I advise you to use prepared statements, using the mysqli functions.
You can then replace the variables in the query by a question-mark or named placeholder:
"INSERT INTO `adm` (`id`, `login`, `adm`, `passwd`, `czas`, `logged`, `ip`, `email`) VALUES (0, 'admin', 1, PASSWORD('admin'), 0, 0, '0.0.0.0', ?);"
and bind $emailaddress using the mysqli_stmt_bind_param function.

Answer 2

You can simply use it like,
$query = "INSERT INTO `adm` (`id`, `login`, `adm`, `passwd`, `czas`, `logged`, `ip`, `email`)
VALUES (0, 'admin', 1, PASSWORD('admin'), 0, 0, '0.0.0.0', '$emailaddress')";
Note: You need to include /settings/contact.inc.php file.
Do Read: sql injection attacks! Learn about prepared statements instead, and use PDO or MySQLi - this article will help you decide which.

Answer 3

You can include the /settings/contact.inc.php and then you can use the $emailaddress variable.

Answer 4

include('/settings/contact.inc.php');
$q=new mysql("INSERT INTO `adm` (`id`, `login`, `adm`, `passwd`, `czas`, `logged`, `ip`, `email`) VALUES (0, 'admin', 1, PASSWORD('admin'), 0, 0, '0.0.0.0', '$emailaddress');");

Answer 5

You can include the file and then you can use the all variable like below.
<?php include_once('/settings/contact.inc.php'); ?>

Answer 6

All the answers was great so i voted up all of them. Besides that way that everyone suggested you can do it by using fopen and fread. I know that way is simple way, but my way is just another way.
$filePath = './settings/contact.inc.php';
$handle = fopen($filePath,"r+");
$content = fread($handle,filesize($filePath));
$array = explode(" ",$content);
foreach($array as $word)
{
if(filter_var($word, FILTER_VALIDATE_EMAIL))
{
$emailaddress = $word;
}
}
fclose($handle);
$q=new mysql("INSERT INTO `adm` (`id`, `login`, `adm`, `passwd`, `czas`, `logged`, `ip`, `email`)
VALUES
(0, 'admin', 1, PASSWORD('admin'), 0, 0, '0.0.0.0', '$emailaddress');");