没有找到MySQL行，但它就在那里

Question

I'm using PHP to try and select a single row from a table in my MySQL database. I've run the query manually inside phpMyAdmin4 and it returned the expected results. However, when I run the EXACT same query in PHP, it's returning nothing.

$query = "SELECT * FROM characters WHERE username=".$username." and charactername=".$characterName."";
if($result = $mysqli->query($query))
{
        while($row = $result->fetch_row())
        {
            echo $row[0];    
        }
        $result->close();
}
else
        echo "No results for username ".$username." for character ".$characterName.".";

And when I test this in browser I get the "No results..." echoed back. Am I doing something wrong?

This isn't a duplicate question because I'm not asking when to use certain quotes and backticks. I'm asking for help on why my query isn't working. Quotes just happened to be incorrect, but even when corrected the problem isn't solved. Below is the edited code as well as the rest of it. I have removed my server information for obvious reasons.

<?PHP
$username = $_GET['username'];
$characterName = $_GET['characterName'];

$mysqli = new mysqli("REDACTED","REDACTED","REDACTED");

if(mysqli_connect_errno())
{
        printf("Connect failed: %s
", mysqli_connect_error());
        exit();
}

$query = "SELECT * FROM `characters` WHERE `username`='".$username."' and `charactername`='".$characterName."'";

if($result = $mysqli->query($query))
{
        while($row = $result->fetch_row())
        {
            echo $row[0];    
        }

        $result->close();
}
else
        echo "No results for username ".$username." for character ".$characterName.".";

$mysqli->close();
?>

Answer 1

It's failing: $mysqli = new mysqli("REDACTED","REDACTED","REDACTED"); because you didn't choose a database.

Connecting to a database using the MySQLi API requires 4 parameters:

• http://php.net/manual/en/function.mysqli-connect.php

If your password isn't required, you still need an (empty) parameter for it.

I.e.: $mysqli = new mysqli("host","user", "", "db");

Plus, as noted.

Your present code is open to SQL injection. Use mysqli_* with prepared statements, or PDO with prepared statements.

---

Footnotes:

As stated in the original post. Strings require to be quoted in values.