Well, code 1 is open to SQL injection because you are not escaping $q. As to why you get two records, that problem is not to be found in code 1 but probably in the code that calls userInput
.
Jakob Kruse
2010-04-27 18:15:28