How to insert a variable in mysql query, which value is text?

Question

PHP

Hello. My site sends the word " lux " to the php file.
Its php meets it like this:

$nnomer = $_POST['nnomer']; // то самое слово lux
$query = "SELECT datestart, dateend FROM main WHERE namenomer = '$nnomer'";

The problem is that the word lux should be in quotes, but in fact it turns out that I have the $nnomer variable in quotes. And when it's in quotation marks, it, variable, becomes an ordinary word. That is, php is looking for namenomer not lux, but $nnomer. Tell me how to be?

Answer 1

You should never write queries this way, because it is a direct road to SQL injection . It would be better to arrange something like

$pdo = new PDO( /* параметры соединения с БД */ );
$result = $pdo->prepare( 'SELECT datestart, dateend FROM main WHERE namenomer = :namenomer' );
$result->execute( array(
    ':namenomer' => empty( $_POST[ 'nnomer' ] ) ? '' : $_POST[ 'nnomer' ]
) );