如何在SQL select语句中使用php变量

Question

I want to get some data from sql server using php but the sql doesn't seem reading the php variable

<?php
$q = $_POST["fl"];
echo $foo;
if ($_POST["fl"] == true);
{
$conn1=odbc_connect('SQLDB','','');
if (!$conn1)
{exit("Connection Failed: " . $conn1);}

 $sql1= "SELECT * FROM dbo.Audit WHERE Details = '$q'";
 $rs1=odbc_exec($conn1,$sql1);
 if (!$rs1)
 {exit("Error in SQL");}
while (odbc_fetch_row($rs1))

Answer 1

First things first, please sanitize the post before you put it inside an SQL query. You have to use htmlentities or even better, PDO.

Second, you can try this if your current one doesn't work:

$sql1 = "SELECT * FROM dbo.Audit WHERE Details = '".$q."'";