Re: Select statement escaping characters question

[Michael Stassen]

You are comparing the page_url column to a constant string (the contents of 
$url_field).  Constant strings must be quoted in SQL (otherwise they look 
like column names).  Since you use double quotes around the whole string, 
you must escape double quotes within the string.  Without escaping, you get 
this (line breaks added for emphasis):

  $result = mysql_query("SELECT page_id FROM page WHERE page_url = "
  $url_field
  "");
You see?  mysql_query expects a string, but you've given it 3.  So, you must 
escape the double quotes.

A better solution is to use single quotes around the string constant.  They 
can't be confused with double quotes, so you wouldn't need to escape them.

  $result = mysql_query("SELECT page_id FROM page
                         WHERE page_url = '$url_field'");
Not only is this simpler, but it is also preferred.  ANSI SQL requires 
single quotes.

Michael
leegold wrote:
Wondered in this example why  $url_field apparently must be in quotes
ie. escaped quotes? Since the whole php/mysql statement is quotes too
wouldn't it interpolate correctly w/out added quotes? What's the idea
behind it? I got this off of a a web tutorial. It's a varchar field.
Thanks for helping w/this newbie type question, Lee G.
$result = mysql_query("SELECT page_id FROM page WHERE page_url =
\"$url_field\"");
--
MySQL General Mailing List
For list archives: http://lists.mysql.com/mysql
To unsubscribe:    http://lists.mysql.com/[EMAIL PROTECTED]