0

I am getting this error:

PDOException: SQLSTATE[42S22]: Column not found: 1054 Unknown column 'Weddings' in 'where clause': SELECT id from galleries_types WHERE name="Weddings"; Array ( ) in catering_gallery_add_image_submit() (line 195

Why does it think 'weddings' is a column? It clearly is where name='Weddings'. What's up with the blank array on the end?

This is the code I am using.

$a = db_query('SELECT id from galleries_types WHERE name="'.$form_state['values']['id'].'"');
  • This question is for Stack Overflow... – mixerowsky Jan 9 '15 at 17:21
1

If you're new to Drupal or PHP coding, you've created a nice example of how not to write an sql query. What you've written is open to SQL-Injection.

Please review the Database API Examples Documentation page.

A "correct" way to write this query using the API could look like (adapting 1 of the top examples to your code) the following.

$result = db_query("SELECT id from {galleries_types} WHERE name = :name", array(':name' => $form_state['values']['id']));

You will want to make use of placeholders in PDO to write your queries.

  • Hi @tenken I think your answer is right but you should not use additional check_plain() call, placeholder value will be sanitized by db_query(). – Bogdan Tur Jan 9 '15 at 21:48
  • ok thanks. I rarely use db queries off of form state like this and forgot the db layer is doing some sanitation itself. – tenken Jan 9 '15 at 22:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.