how to use $_GET inside mysqli_query? [duplicate] - php

Question

This question already has answers here:
How to include a PHP variable inside a MySQL statement
(5 answers)
Closed last year.
I'm trying to make like few text boxes and upon submit another php will be connected let's say it's database.php then the database.php will insert what's in the textboxes into the mysql database table but I'm not sure how I should be into the mysqli_query code....what I have now is
mysqli_query($db,"INSERT INTO jliu VALUE(null,$_GET['title'],$_GET['fname'],$_GET['lname'],$_GET['description'])");
and of course the $_GET won't work properly. I can't really figure how to get it correctly.

Answer 1

You need to break out of the string in order to concatenate it with the $_GET variables.
mysqli_query($db,"INSERT INTO jliu VALUES(null,".$_GET['title'].",".$_GET['fname'].",".$_GET['lname'].",".$_GET['description'].")");
But really you should look into prepared statements to avoid the gaping SQL injection security hole above.
With prepared statements you would be binding the $_GET variables to the parameters in the query.
$stmt = mysqli_prepare($db,"INSERT INTO jliu VALUES(null, ?, ?, ?, ?");
mysqli_stmt_bind_param($stmt, "s", $_GET['title']);
...
// and the same for the others
There's some more detail in the linked manual page on how to execute the prepared statement and return the result.

Answer 2

Please don't use mysql_query() and consorts, they are way too unsafe. Do have a look at PDO and use that instead. Specifically PDO::prepare() and PDOStatement::execute() will be your solution.

Answer 3

Your actual issue, inserting index values of an array into a string can be solved in two ways (more if you count heredoc, sprintf and whatnot):
Use curly braces:
"INSERT INTO jliu VALUE(null, {$_GET['title']}, {$_GET['fname']}, {$_GET['lname']}, {$_GET['description']})"
Use concatenation:
"INSERT INTO jliu VALUE(null, " . $_GET['title'] . ", " . $_GET['fname'] . ", " . $_GET['lname'] . ", " . $_GET['description'] . ")"
However, the overriding issue is that you shouldn't be doing this. With your code, you're wide open to SQL Injection vulnerabilities.
Use prepared statements, and insert your values in there. This creates a more secure (and marginally more performant) query, as you're only binding the values, and not changing the actual query itself. Code example:
if ($stmt = $mysqli->prepare("INSERT INTO jliu VALUES (NULL, ?, ?, ?, ?)")) {
$stmt->bind_param("ssss", $_GET['title'], $_GET['fname'], $_GET['lname'], $_GET['description']);
$stmt->execute();
}

Answer 4

You have to use a prepared statement and replace the variables with a placeholder.
http://php.net/manual/de/mysqli.prepare.php

Answer 5

Answering your question:
You may do something like below. Actually, that is to put a variable of array item into a string, not only for $_GET. Any array may be accessed like that:
$str = "some text {$_GET['title']}"
Or similar approach when you are working with objects:
$str = "some text {$obj->test}"
But, that is bad idea when you are working with sql queries. You should use some functions to clear your input in order to prevent sql injections.
The most stratiforward way is to use mysqli_real_escape_string:
$str = "some text " . mysqli_real_escape_string($_GET['title'])." ...";
Or you can use prepared statements which are more flexible

Answer 6

try this..
$title = mysqli_real_escape_string($_GET['title']);
$fname = mysqli_real_escape_string($_GET['fname']);
$lname = mysqli_real_escape_string($_GET['lname']);
$description = mysqli_real_escape_string($_GET['description']);
$stmt = mysqli_prepare($db,"INSERT INTO jliu VALUES(null,'".$title."','".$fname."','".$lname."','".$description."'");
mysqli_stmt_execute($stmt);

Answer 7

It should be like this.
$query = sprintf("INSERT INTO jliu VALUE(null,%s,%s,%s,%s)",$_GET['title'],$_GET['fname'],$_GET['lname'],$_GET['description']);
mysqli_query($db,$query);