PHP中的SQL查询语法错误

Question

I am trying to do a simple query on my MySQL db and echo back the result. I am getting the following error:

Parse error: syntax error, unexpected '' (T_ENCAPSED_AND_WHITESPACE), expecting identifier (T_STRING) or variable (T_VARIABLE) or number (T_NUM_STRING)

This is the code for my query:

$result = mysqli_query($connection, "SELECT FROM table_name WHERE value='$_POST["searchname"]'";
echo $result;

I'm assuming it is a simple syntax error in the SQL statement, but I just am not seeing it. Thanks for the help!

Answer 1

You need to ensure you are using quotes appropriately when building a string:

$result = mysqli_query($connection, "SELECT * FROM table_name WHERE value='".$_POST["searchname"]."'";

Also I hope you are aware that either way this type of statement is vulnerable to sql injections. You should ideally use prepared statements or some sort of validation or escape to the input.