PHP Select Statement

[danmo]

Hello,

 

I'm not sure whether to put this in the PHP or MySQL section, but here goes.

 

Here is my PHP code:

$queryUSR = "SELECT * FROM usr_permissions WHERE usr_id =".$_REQUEST['usr_id']."AND dept_id=".$_SESSION['SESS_CURLHD_ID'];

 

However, I always get the following error if I include the part from "AND dept_id..." on.

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1

 

The field names are all correct and the variable names as well. If I put in the select statement in MySQL workbench, it also produces the correct results.

 

Thank you for your time. 

[beyzad]

Hello,

 

I'm not sure whether to put this in the PHP or MySQL section, but here goes.

 

Here is my PHP code:

$queryUSR = "SELECT * FROM usr_permissions WHERE usr_id =".$_REQUEST['usr_id']."AND dept_id=".$_SESSION['SESS_CURLHD_ID'];

 

However, I always get the following error if I include the part from "AND dept_id..." on.

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1

 

The field names are all correct and the variable names as well. If I put in the select statement in MySQL workbench, it also produces the correct results.

 

Thank you for your time. 

 

Hi.

 

Maybe you should add a space before AND? And hello? Where are you quotations?

[Jessica]

Echo the entire query. Post the section of PHP code.

Read this post: http://forums.phpfreaks.com/index.php?topic=365029.msg1730174#msg1730174

[Barand]

If you are going to concatenate string values, don't forget to leave spaces.

 

Or

$queryUSR = "SELECT * FROM usr_permissions WHERE usr_id =  {$_REQUEST['usr_id']} AND dept_id = {$_SESSION['SESS_CURLHD_ID']}";

 

 

@beyzad

And if those ids are numeric they don't need (and shouldn't have) quotes

[Jessica]

@Barand I think his user id var is empty too.

[Christian F.]

beyzad: You also need to read up on SQL injections, output escaping and input validation. Your script is wide open to for anyone who'd like to attack it, and thus retrieve any information they like from the database.

[Barand]

Pay attention, Christian!. Danmo was the guy who posted the query

[Christian F.]

Damnit! This laptop screen is too small.

 

*Assumes the flogging position.*

[beyzad]

Man you made me scare

[Christian F.]

Heh, sorry about that.

Though, never hurts to read up on those subjects still: Always nice to keep current.