I am always unsure, and I find myself playing around with it a lot.
Is this proper?
$game_name = "poker"; (Included from Config.php)
$game_name_lower = strtolower($game_name);
$sql = "SELECT * FROM `winners` WHERE `game` = '$game_name_lower'";
I am always unsure, and I find myself playing around with it a lot.
Is this proper?
$game_name = "poker"; (Included from Config.php)
$game_name_lower = strtolower($game_name);
$sql = "SELECT * FROM `winners` WHERE `game` = '$game_name_lower'";
It is impossible to say without seeing the code around it. If $game_name_lower
comes directly from user input then it certainly is not. Otherwise the quoting is fine, if unnecessary in all cases.
Yes, looks fine. However, you may want to consider using prepared statements instead. Quoting the PHP Manual on the topic:
Prepared statements offer two major benefits:
The query only needs to be parsed (or prepared) once, but can be executed multiple times with the same or different parameters. When the query is prepared, the database will analyze, compile and optimize it's plan for executing the query. For complex queries this process can take up enough time that it will noticeably slow down an application if there is a need to repeat the same query many times with different parameters. By using a prepared statement the application avoids repeating the analyze/compile/optimize cycle. This means that prepared statements use fewer resources and thus run faster.
The parameters to prepared statements don't need to be quoted; the driver automatically handles this. If an application exclusively uses prepared statements, the developer can be sure that no SQL injection will occur (however, if other portions of the query are being built up with unescaped input, SQL injection is still possible).
Should be something like this you don't need the ' around the table name or column name.
$dbc = mysql connection;
$q = "SELECT * FROM winners WHERE game = '$game_name_lower'";
$r = @mysqli_query($dbc, $q);
Actually here is very little of PHP quotation.
Only surrounding "
belongs to PHP.
The rest is mysql thing.