Php postgresql variables in a query

Question

I'm trying to get the right syntax for the following. In this case $post_pub = 1

$sql='SELECT "Publications"."Pub_ID", "Publications"."ART_TITEL" FROM "Publications" where "Pub_ID"="$post_pub"';

Php throws an error: column "$post_pub" does not exist

I've stumbled across pg_query_params, this feels like the right direction, but I need some help. How can I get this to work?

Answer 1

I never used pg_connect though I think you need something like this:

$sql='SELECT "Publications"."Pub_ID", "Publications"."ART_TITEL" 
FROM "Publications" 
where "Pub_ID"=$1 ';


$result = pg_query_params($dbconn, $sql, array($post_pub));

Answer 2

the problem is double quotes around variable. Postgres understands it as "database object" name, in this part of query, a column. to avoid it, try using:

$sql='SELECT "Publications"."Pub_ID", "Publications"."ART_TITEL" FROM "Publications" where "Pub_ID"='."$post_pub";

also consider moving to PDO - such usage is a straight invitation for sql injection. Setting$post_pub to 0 or (delete from Publications)" will delete all data if user has enough right, for example.