单引号中无法识别变量[重复]

Question

This question already has an answer here:

• How to escape single-quote (apostrophe) in string using php 4 answers
• How can I prevent SQL injection in PHP? 28 answers

I have this SQL query:

mysql_query("INSERT INTO Messages (MessBody,Subject,Date,StaffID,AppID) 
            VALUES ('Your application's status has been changed to ".$_POST['offer']."','Application Status Changed',NOW(),".$_SESSION['StaffUser'].",".$_SESSION['AppID'].")");

The variable $_POST['offer'] is not working. I think is the way I append it in the text. I tried several different ways but none is working. If I replace the variable with text, then the record will be added into the database though.

I know is something silly, but I can't figure it out. I'm a bit confused, to be honest when to use single quotes and when double, so that might be another reason, why I can't figure it out.

</div>

Answer 1

You have single quote missing at various places. try using below query

mysql_query("INSERT INTO Messages (MessBody,Subject,Date,StaffID,AppID) 
        VALUES ('Your application\'s status has been changed to ".mysql_real_escape_string($_POST['offer'])."','Application Status Changed',NOW(),'".mysql_real_escape_string($_SESSION['StaffUser'])."','".mysql_real_escape_string($_SESSION['AppID'])."')");