mysql查询中的$ _SESSION变量？

Question

Whenever I try a query like:

mysql_query("SELECT * FROM data WHERE `user`=$_SESSION['valid_user'] LIMIT 1");

it doesn't work. Why? I escaped the variable, then tried it without, and tried putting quotes around the variable. I know i can do:

$user = $_SESSION['valid_user'];

but shouldn't it work without? Thanks.

THE ANSWER:

PHP can't recognize $_SESSION['valid_user'] due to the single quotes. So either use curly braces {} or take our the single quotes.

Thanks for helping me everyone.

Answer 1

PHP can't recognise variables inside a string that have square brackets and so on, you have to wrap it in curly brackets to get it to recognise it.

mysql_query("SELECT * FROM data WHERE user={$_SESSION['valid_user']} LIMIT 1");

However - You should always escape any data going into a SQL query, try the example below.

$validUser = mysql_real_escape_string($_SESSION['valid_user']);
mysql_query("SELECT * FROM data WHERE user='$validUser' LIMIT 1");