Is this MySql Query Statement correct?

Question

Hi

I would like to know whether this MySql statement will be executed correctly,

"SELECT sum(price) FROM products WHERE productid IN (SELECT productid FROM shoppingcart WHERE sessionid=".$this->$sessionid.")"

And if not please give me pointers as to where I am wrong.

Thanks

Answer 1

i am using sql server but i think error over here is

single quote ' is required for session id

        "SELECT sum(price) FROM products WHERE productid IN (SELECT productid 
    FROM shoppingcart WHERE sessionid='".$this->$sessionid."')"

Answer 2

Seems fine to me.

Answer 3

I'm sure you meant

$this->sessionid

not

$this->$sessionid

(the second one returns value of property, which name is stored in sessionid, thus, when $sessionid is 'abcdef', it tries to return value of $this->abcdef property).

Also, enclose in ' AND escape all parameters.

"SELECT sum(price) FROM products WHERE productid IN (SELECT productid FROM shoppingcart WHERE sessionid='".mysql_escape_string($this->sessionid)."')";

Answer 4

As @praynay said, I believe you need quotes around the session id.

Also, be very, very sure $this->sessionid will not have a quote character in itself, or that you escape it properly before passing it to MySQL. (Or better yet, use a parameterized query.)