Drawing up a session value within SQL query? PHP and MySQL

Question

Hi, on one of my web pages I want my manager user to view all activities assigned to them (personally). In order to do this, I need something like this:

$sql = "SELECT * FROM activities WHERE manager = $_SESSION['SESS_FULLNAME']";

Now obviously this syntax is all wrong, but because I am new to this stuff, is there a way I can call up the full name from the user's session within a query? This is so that when I call up the database values to be displayed within the web page, only the activities for the manager who is logged in is displayed. For example, the activities table has a manager column of a full name entry. Any help is much appreciated. Thanks.

Answer 1

$sql = "SELECT * FROM activities WHERE manager = '".$_SESSION['SESS_FULLNAME']."'";

To use a variables in a query you should use quote...

use ' to define a string in query..

ie. if manager is a number use WHERE manager = ".$_SESSION['SESS_FULLNAME'] (without ')
if manager is a string WHERE manager = '".$_SESSION['SESS_FULLNAME']."'

Answer 2

Actually, you do not have to "leave" the string. You can more easily do this:

$sql = "SELECT * FROM activities WHERE manager = {$_SESSION['SESS_FULLNAME']}";

See PHP's double-quoted string syntax for more info.

That said, please use either prepared statements or escaped variables (in that order of preference) when dealing with dynamic parameters.