Column state belongs to table2 and consists of the following varchars: "AL","AK",..
In my php code I have the following String: $states="AL,AK,AZ,IL";
I tried to use it in mySQL query in the following way:
$query = SELECT * FROM 'table2' WHERE 'state' IN('$states');
It does not show any results... What is the correct syntax for those apostrophes?
The reason why it is not working is because:
IN statement is not wrap with single quoteTry this,
$individualStates = explode(",", $states);
$newState = "'" . implode("','", $individualStates) . "'";
$query = "SELECT * FROM table2 WHERE state IN($newState)";
when parsed, the output of the statement is,
SELECT * FROM table2 WHERE state IN('AL','AK','AZ','IL')
As a sidenote, the query is vulnerable with SQL Injection if the value(s) of the variables came from the outside. Please take a look at the article below to learn how to prevent from it. By using PreparedStatements you can get rid of using single quotes around values.
This:
$states_in = "'" . implode("','", $individualStates) . "'";
Is bad. You're opening yourself to SQL injection. Instead, do this:
$states = explode(',', $states);
$states_in = array_map(array($instancePDO, 'quote'), $states);
$states_in = implode(',', $states_in);
If you prefer to use prepared statements instead, this will give you the placeholder string:
$states_placeholder = implode(',', array_fill(0, count($individualStates), '?'));
<select> tags...So that must exclude possibility of any injection. I do not use <input> Or is there still possibility for injection?$states = explode(',', $states);
$states = array_map(function($value){return "'$value'";}, $states);
$query = "SELECT * FROM `table2` WHERE `state` IN(".implode(',', $states).")";
But better to use prepared statement. Read relative question.
FIND_IN_SET()instead of theINclause.