building a dynamic sql query with php (using variables passed in from flash)

[natronp]

okay tha thread title is too long!

i'm outputting xml from php that makes a sql query to a mysql database.
that all works if I hardcode in the query.

i'd like to access variables i'm passing in from flash (via loadvars, POST method) and use them in my query.

it should be simple but I'm pretty much a php noob. if anyone can shed some light that'd be appreciated!

i get this xml back (traced out of flash) with accompanying error:

<?xml version="1.0" encoding="UTF-8"?><datapacket><br />
<b>Warning</b>: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in <b>/home/virtual/site370/fst/var/www/html/products/flashDIr/getDetails.php</b> on line <b>16</b><br />
</datapacket>

this is my php:

<?php

//this line includes the database connection variables
include_once("config.php");
//set vars from flash
$first = $first;
$last = $last;

$result = mysql_query("SELECT * FROM members WHERE last=$last AND first=$first ORDER BY last");

// And now we need to output an XML document
// We use the names of columns as <row> properties.

echo '<?xml version="1.0" encoding="UTF-8"?>';
echo '<datapacket>';
while($row=mysql_fetch_array($result)){
$line = '<member last="'.$row[last].'" first="'.$row[first].'" user="'.$row[user].'" pass="'.$row[pass].'" address1="'.$row[address1].'" address2="'.$row[address2].'" city="'.$row[city].'" state="'.$row[state].'" zip="'.$row[zip].'" home="'.$row[home].'" work="'.$row[work].'" fax="'.$row[fax].'" email="'.$row[email].'" photo="'.$row[photo].'"/>';
echo $line;
}
echo '</datapacket>';
?>

[Aggrix]

Try adding single quotes around your variables in your select query:

$result = mysql_query("SELECT * FROM members WHERE last='$last' AND first='$first' ORDER BY last");

[ethos_bass]

Try adding single quotes around your variables in your select query:

$result = mysql_query("SELECT * FROM members WHERE last='$last' AND first='$first' ORDER BY last");


What is the correct syntax to use if the LIKE string contains array variables? I cannot find this documented anywhere obvious.

Here's an example of my code that doesn't seem to work:

$query="select * FORM bar_index WHERE region LIKE %$region_array[0]%"

I have a character string stored in the $region_array[0] variable and I want to find any listing in my table who's region contains the characters in the variable. Should the entire LIKE sting be in single or double quotes? Should the variable itself be in singe or double quotes?

Thank you, in advance, for any insight you can offer.