奇怪的情况| 您的SQL语法有错误; 检查与MySQL服务器版本对应的手册[关闭]

Question

I have a strange situation. I have this code:

$dispnam = strtoupper($display_name);
$data = mysql_connect("localhost", "user", "pass");
mysql_select_db("dbname");
$result = mysql_query("SELECT location FROM upload WHERE name = '".$dispnam."'")
or die(mysql_error());  
$check = mysql_num_rows($data);
$info = mysql_fetch_array($data);
$display_url = $info['location'];
echo $display_url;

which returns an error 'You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'HIGHLIGHT'>BATMAN_SLAPPING_ROB' at line 1'

I have no idea where have I gone wrong. Your help will be greatly appreciated. Thanks iin advance!

Answer 1

$dispnam seems to contain a single quote. You should be using a parametrized query instead of constructing your query from strings