Column and Variable names using PHP and mysql

[kreut]

Hello,

 

I'm having some issues with PHP thinking that the variables that I send it are the actual columns in my database.  First, I pull off Quadratic_Functions and introductory_problem from http://localhost:8888/algebra_book/Chapters/Quadratic_Functions/introductory_problem.php using the code below:

 

$chapter_page =  $_SERVER['PHP_SELF'];
$chapter_page_array = explode('/',$chapter_page);
$size =count($chapter_page_array); 
$chapter = $chapter_page_array[$size-2];
$page = $chapter_page_array[$size-1]; 
$page_array = explode('.', $page);
$page = $page_array[0];

 

Based on my printing of the variables $chapter and $page I think that it's doing what I want it to do.  I then use the following function:

 

$supplemental_id = getSupplementalId($dbRead,$chapter,$page); 

 

to check out if the there's a supplemental_id for the Quadratic_Function chapter and introductory_problem page name via:

 

function getSupplementalId($read,$user_id,$chapter,$page)
  { 
  $sql = "SELECT supplemental_id
  			FROM instructors_supplemental
		WHERE page_name = $page
		AND chapter_name='$chapter";

return $read->fetchRow($sql);
  }

 

If I stick in actual values, as seen below, the thing runs fine.

 

$sql = "SELECT supplemental_id
  			FROM instructors_supplemental
		WHERE page_name = 'introductory_problem'
		AND chapter_name='Quadratic_Functions'";

 

But if I run it in the abstract version, with variables for page and chapter name (the first version), I get Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42S22]: Column not found: 1054 Unknown column 'introductory_problem' in 'where clause'' in...

 

It's almost as if it thinks that my variables are the names of the columns. 

 

Any thoughts would be appreciated....

[btherl]

Try this:

 

WHERE page_name = '$page'

 

The difference is quotes around $page.

[kreut]

Hmmmm.....that did the trick!  (THANKS....) But, why?

 

I have many other database queries on my site and this is the first time that I need the single quote.  Could it be that all of the others are either $_POSTS or $_GETS.  It's a bit of a mystery to me 

 

Any further clarification would be appreciated.

[btherl]

If it's a number then you don't need the quotes (though it's a good idea to use them, as well as mysql_real_escape_string(), to avoid SQL injection).  If it's a string and it works, then the quotes ARE getting added somehow.  I couldn't tell you how without seeing the code.

[kreut]

OK...I don't want to trouble you more on this.  I'll dig into my code:  maybe I am actually putting numbers into the other guys.

 

Thanks again....