Syntax error when use query in php

Question

Anybody help me solve this query, error is syntax error,

unexpected '' (T_ENCAPSED_AND_WHITESPACE), expecting identifier (T_STRING) or variable (T_VARIABLE) or number (T_NUM_STRING)

 $sl = "select * from sanpham where id='$_GET['id']'";

Please dont use this code, Parameterize your query. – chris85 Sep 10 '17 at 17:01 — chris85, Sep 10 '17 at 17:01

score 0 · Accepted Answer · answered Sep 10 '17 at 17:01

0

Careful with arrays and keys.

 $sl = "select * from sanpham where id='{$_GET['id']}'";

Or

 $sl = "select * from sanpham where id='" . $_GET['id'] . "'";

answered Sep 10 '17 at 17:01

Jerry

Careful with `$_GET` in SQL as well. – chris85 Sep 10 '17 at 17:02
True ! if id can't be anything else than an integer, he should use : $sl = "select * from sanpham where id=" . intval($_GET['id']); – Jerry Sep 10 '17 at 17:05
Preferred approach is `select * from sanpham where id = ?` then it wont matter what it is. – chris85 Sep 10 '17 at 17:09
thank you, and this – Nguyễn Minh Huy Sep 10 '17 at 17:15
$kq= mysqli_query($sl); if( mysqli_num_rows($kq) > 0){ $d = mysql_fetch_array($kq); } and error are mysqli_query() expects at least 2 parameters, mysqli_num_rows() expects parameter 1 to be mysqli_result, null given – Nguyễn Minh Huy Sep 10 '17 at 17:16
Yes.. Look at http://php.net/manual/fr/mysqli.query.php . mysqli_query need to be called with the link. – Jerry Sep 10 '17 at 17:17

1 Answers1