phpmysqlsecuritymagic-quotes

PHP using a variable in a mysql query with magic_quotes

I have a mysql query that uses a value in an array as part of the WHERE statement. How am I supposed to include this variable?

Here is the sql: "AND gender = '{$user_array[\"gender\"]}'"

PHP returns this error: Parse error: syntax error, unexpected T_CONSTANT_ENCAPSED_STRING, expecting T_STRING

I have magic_quotes turned on. I've seen some posts suggesting setting the array's value to another variable, but seems unnecessary if I have magic quotes. Is this correct?

Solution 
  • "AND gender = '{$user_array['gender']}'"

    It was the backslashes that were killing it.

    Or you can even do:

    "AND gender = '$user_array[gender]'"

    Or:

    "AND gender = '" . $user_array['gender'] ."'"

    Demo: http://codepad.org/lrJllI1K

    But all of this put together, you should be using prepared queries