what is correct way to do this php code

Question

I have this query

$query = "SELECT * FROM customers WHERE customer_name = '{$orders}'";

but when the value of the $orders have a single quote(') for example:

$orders = "Carlo's shop";

the query return an error.

is there any good way to handle this situation?

Answer 1

Use PDO with prepared statements. See reference docs.

$query = $pdo->prepare('SELECT * FROM customers WHERE customer_name= :orders');

$query->execute(array('orders' => $orders));

---

• You can also look into using mysqli with prepared statements.