1

I am getting this error:

PDOException: SQLSTATE[42S22]: Column not found: 1054 Unknown column 'Weddings' in 'where clause': SELECT id from galleries_types WHERE name="Weddings"; Array ( ) in catering_gallery_add_image_submit() (line 195

Why does it think 'weddings' is a column? It clearly is where name='Weddings'. What's up with the blank array on the end?

This is the code I am using.

$a = db_query('SELECT id from galleries_types WHERE name="'.$form_state['values']['id'].'"');
1
  • This question is for Stack Overflow...
    – mixerowsky
    Jan 9, 2015 at 17:21

1 Answer 1

2

If you're new to Drupal or PHP coding, you've created a nice example of how not to write an sql query. What you've written is open to SQL-Injection.

Please review the Database API Examples Documentation page.

A "correct" way to write this query using the API could look like (adapting 1 of the top examples to your code) the following.

$result = db_query("SELECT id from {galleries_types} WHERE name = :name", array(':name' => $form_state['values']['id']));

You will want to make use of placeholders in PDO to write your queries.

2
  • Hi @tenken I think your answer is right but you should not use additional check_plain() call, placeholder value will be sanitized by db_query().
    – Bogdan Tur
    Jan 9, 2015 at 21:48
  • ok thanks. I rarely use db queries off of form state like this and forgot the db layer is doing some sanitation itself.
    – tenken
    Jan 9, 2015 at 22:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.