PHP SQL database query error message - php

Question

Is there anything wrong with this SQL code? I got it from a tutorial, but it's returning the following error message
Database query failed: You have an
error in your SQL syntax; check the
manual that corresponds to your MySQL
server version for the right syntax to
use near 'LIMIT 1' at line 1
function get_subject_by_id($subject_id) {
global $connection;
$query = "SELECT * ";
$query .= "FROM subjects ";
$query .= "WHERE id=" . $subject_id ." ";
$query .= "LIMIT 1";
$result_set = mysql_query($query, $connection);
confirm_query($result_set);
// if no rows are returned, fetch array will return false
if ($subject = mysql_fetch_array($result_set)){
return $subject;
} else {
return NULL;
}
}

Answer 1

Best to echo the query and see what it looks like.
Probably $subject_id contains no value or an invalid value. If $subject_id is a string, you should escape it (using mysql_real_escape_string) and put it inside quotes in the query.
[Edit]
You know you can put enters in strings too, right?
// More readable
$query = "
SELECT *
FROM subjects
WHERE id = $subject_id
LIMIT 1";

Answer 2

$query .= "where id=" . $page_id . " ";
Needs to be put within single quotes. Replace the above statement by
$query .= "where id='" . $page_id . "' ";

Answer 3

Frankly, it's impossible to say what is exactly wrong with this code, not knowing what values are substituted in the query in place of variables.
Apart from that, the code in question may be subject to SQL injection attacks.
If I may put together other suggestions that will make sure no error is ever generated with this code:
function get_subject_by_id($subject_id) {
global $connection;
$query = "SELECT * ";
$query .= "FROM subjects ";
$query .= "WHERE id='" . mysql_real_escape_string($subject_id) ."' ";
// note the quotes and escaping wrapper
$query .= "LIMIT 1";
$result_set = mysql_query($query, $connection);
confirm_query($result_set);
// if no rows are returned, fetch array will return false
if ($subject = mysql_fetch_array($result_set)) {
return $subject;
} else {
return NULL;
}
}
Additionally, using global variables is a bad practice nowadays, so I suppose the example you're using is quite outdated.

Answer 4

Try to use mysql_real_escape_string()

Answer 5

function get_subject_by_id($subject_id) {
global $connection;
$query = "SELECT * ";
$query .= "FROM subjects ";
$query .= "WHERE id='" . $subject_id ."' "; //You need single quotes
$query .= "LIMIT 1";
$result_set = mysql_query($query, $connection);
confirm_query($result_set);
// REMEMBER:
// if no rows are returned, fetch_array will return false
if ($subject = mysql_fetch_array($result_set)) {
return $subject;
} else {
return NULL;
}
}
$query .= "WHERE id='" . $subject_id ."' "; //work
$query .= "WHERE id=" . $subject_id ." "; //not work