将PHP变量传递给MySQL查询

Question

What is wrong with this code? I get an empty array. I am passing a PHP variable to the query, but it doesn’t work; when I give a hardcoded value the query returns a result.

echo $sub1 = $examSubject[$i];
$subType = $examType[$i];
$query = $this->db->query("select dSubject_id from tbl_subject_details where dSubjectCode='$sub1'");
print_r($query->result_array());

Answer 1

Look up “SQL injection”.

I’m not familiar with $this->db->query; what database driver are you using? The syntax for escaping variables varies from driver to driver.

Here is a PDO example:

$preqry = "INSERT INTO mytable (id,name) VALUES (23,?)";
$stmt = $pdo->prepare($preqry);

$stmt->bindparam(1,$name);
$stmt->execute();