[Aakash_Choudhary]

Hello master. I need help. I want SQL Query for :- Double quotes string

Here is my code --->

PHP Code


<?php 
include 'connection.php';

                    if(isset($_GET["id"])) {
                    //$id = '"' . $id . '"';
                    $id = $_GET["id"];
                    $query = $conn->query(" SELECT * FROM students WHERE id= ($id) ");
                        if(!$query) {
                            echo "Error: " . mysqli_error($conn);
                        } else {
                            $data = mysqli_fetch_assoc($query);
                            echo "<h1>" .$data["firstname"]." ". $data["lastname"] . "</h1>";
                        }
                } else {
                    echo "<p>Please input the ID as parameter with numeric value like -> ?id=1</p>";
                } 


If i uncomment this -->

PHP Code


<?php 
$id = '"' . $id . '"'; 


then i see error -->

Notice: Undefined variable: id in /opt/lampp/htdocs/AAKASH/FULL PHP/WebTest/SQLI LEVEL/String-2/index.php on line 25

[SourSauce]

The mysqli functions have been deprecated by the introduction of the PDO class.
Developers creating websites with SQL database interaction are urged to use the PDO class instead of mysqli.

PHP Code


<?php 
$id = '"' . $id . '"'; 


Why are you trying to assign $id to a string of it's self?
This has no use at all, the value of $id is already assigned to the $_GET superglobal.
Just remove that line from your code.

Also if you're going to use mysqli make sure to use the htmlspecialchars function.

[Squito]

The mysqli functions have been deprecated by the introduction of the PDO class.

Please stop spreading this! MySQLi is NOT deprecated! The outdated and not supported mysql extension is deprecated. Eventually the MySQLi (its full name is "MySQL Improved Extension") and PDO extensions are both the replacement for the mysql extension. The main difference is that PDO supports about a dozen database drivers, while MySQLi only one (but supports procedural way). Both MySQLi and PDO supports prepared statements.

PHP Code


<?php 
$id = '"' . $id . '"'; 


Why are you trying to assign $id to a string of it's self?
This has no use at all, the value of $id is already assigned to the $_GET superglobal.
Just remove that line from your code.

Well register_globals if off by default, which means it probably wouldn't work. Also this feature is deprecated as of PHP 5.3.0 and removed as of PHP 5.4.0 (PHP 5.6.9 is the current stable release).
http://php.net/manual/en/ini.core.php#in...er-globals

Also if you're going to use mysqli make sure to use the htmlspecialchars function.

No, that has to be used when outputting (for example using echo or print) data from the database. When running queries prepared statements should be used to properly secure the query.

[SourSauce]

Please stop spreading this! MySQLi is NOT deprecated! The outdated and not supported mysql extension is deprecated. Eventually the MySQLi (its full name is "MySQL Improved Extension") and PDO extensions are both the replacement for the mysql extension.

> It isn't deprecated.

In the documentation it clearly states that it is deprecated.
Why would you want to use mysqli anyways when you have the amazing advantage of using PDO?

[Aakash_Choudhary]

Thanks you both who commented here. I editing my query and now its working.
I like MySQLi style so i am using this. And yes in future i will learn PDO too
🤝

[Squito]

> It isn't deprecated.

In the documentation it clearly states that it is deprecated.
Why would you want to use mysqli anyways when you have the amazing advantage of using PDO?

Okay, let's settle this:
http://php.net/manual/en/mysqlinfo.api.choosing.php
Look at the table under "Feature comparison".

Check any of the mysql_ functions and you'll see this:

Warning This extension is deprecated as of PHP 5.5.0, and will be removed in the future. Instead, the MySQLi or PDO_MySQL extension should be used.

You won't see this under any MySQLi functions.

[hellomen]

> It isn't deprecated.

In the documentation it clearly states that it is deprecated.
Why would you want to use mysqli anyways when you have the amazing advantage of using PDO?

read my PM.
You are reading it wrong.
I gave you all the information on what point you're wrong.

@OP:

You can escape using back-slashes: "\"" would do: \"
- just an option...

[SourSauce]

PDO is still more recommended than mysqli.

[Squito]

PDO is still more recommended than mysqli.

Because - like I said before - it supports about a dozen database drivers, not just MySQL.
http://php.net/manual/en/pdo.drivers.php

[DAVEologist]

MySQLi is NOT deprecated. 'Nuff said. Maybe you mean the MySQL functions being deprecated.

OP is using MySQLi here. It's just the procedural approach. You should look into prepared
statements, they're more secure.

Also, the error that you encountered is normal. The $_GET['id'] is not always defined, so you should
add a code that checks if it is defined.

PHP Code


<?php 
if(isset($_GET['id'])) {
 // do code here if $_GET['id'] is defined and set
} 


[selinux]

I assure anyone that MySQLi is not deprecated, but I will state my opinion of PDO being easier to use than MySQLi. Remember, just an opinion.