SELECT query inside PHP class

Question

I am trying to run a simple SELECT query inside of a PHP class, using the GET variable.

$this->Token = $_GET['Token'] ?? null;

function getRows(){   
        $query = $this->db->query("SELECT * FROM store_product_images WHERE token = ".$this->Token." ORDER BY display_order ASC");

When I run this, nothing shows, if I remove the WHERE it works fine

Your code is vulnerable to SQL injection attacks. Instead of building queries with string concatenation, always use prepared statements with bound parameters. See this page and this post for some good examples. — Alex Howansky
– Alex Howansky, Commented Apr 18, 2021 at 16:31
If token is a string, you would need quotes round the value,but using prepared statements solves this and a few other problems. — Nigel Ren
– Nigel Ren, Commented Apr 18, 2021 at 16:32
@NigelRen It does have quotes around it? Could you show me an example of what you mean? — Designer
– Designer, Commented Apr 18, 2021 at 16:32
You missed the quote to indicate that you passed a string on your query. You better write it like this [...] WHERE token = '{$this->Token}' ORDER BY [...]. Anyway, you should really consider to escape your value, or better to use prepared statement, as another has mentioned, your code is vulnerable to SQL injection. — Ammar Faizi
– Ammar Faizi, Commented Apr 18, 2021 at 16:38

ha3an · Accepted Answer · 2021-04-18 17:55:23Z

1

you missed the quote

$query = $this->db->query("SELECT * FROM store_product_images WHERE `token`= '".$this->Token."' ORDER BY display_order ASC");

answered Apr 18, 2021 at 17:55

ha3an

822 silver badges15 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

SELECT query inside PHP class

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related