I have a simple module to use the flag module base on the session api. This was working in drupal 6 (and another section working for logged in users), i changed the syntax for drupal 7 (remove db_results wrapper), and am getting some error i dont understand.

This is my code.

  $cookieid = $_COOKIE['session_api_session'];
  $sid = db_query('SELECT sid FROM {session_api}  WHERE session_id = "' . $cookieid . '"')->fetchField();

    // Returns a value only if the anonymous user has at least one bookmark
   $result = db_query('SELECT fid FROM {flag_content}  WHERE sid = ' . $sid . '' )->fetchField();

This is the error I get:

Notice: Undefined index: session_api_session in flag_here_preprocess_html() (line 19 of /home/dev/drupal-7.x/sites/www.site.com/modules/flag_here/flag_here.module).

PDOException: SQLSTATE[42S22]: Column not found: 1054 Unknown column '' in 'where clause': SELECT sid FROM {session_api} WHERE session_id = "";

Array ( ) in tmc_flag_here_preprocess_html() (line 20 of /home/dev/drupal-7.x/sites/www.site.com/modules/flag_here/tmc_flag_here.module).

All the data exist.


I really don't understand what is going on here.

I have a feeling it is something with $_COOKIEand the session_api_session, but I could be off.

1 Answer 1


Quoting value with " characters in MySQL is wrong. The MySQL string quote is '. The " character is the character used to quote table or columns names. With an empty value in $cookieid you have an SQL query searching session-id equals to a column named empty string, this is the

PDOException: SQLSTATE[42S22]: Column not found: 1054 Unknown column '' in 'where clause': SELECT sid FROM {session_api} WHERE session_id = "";

with 'foo' as session uid you would have a query searching for rows having session_id columns equals to value of "foo" column. It would also be wrong.

Use Drupal helpers to write queries. Field and value escapes will be the right ones for the right engine:

$sid = db_query(
  'SELECT sid FROM {session_api}  WHERE session_id = %my_sid',
   array('%my_sid' => $cookieid

Or even more D7 (untested but it's something like that):

 $query= db_select('session_api','s');
 $sid = $query->fetchField();

now the 1st error message says there is nothing in $_COOKIE['session_api_session']. So you should enclose your code in a:

if (array_key_exists('session_api_session',$_COOKIE) 
 && !empty($_COOKIE['session_api_session'])) {

At least you will avoid the warnings and errors.

About session api usage I would certainly better use session api functions to retrieve the current id, something like session_api_get_sid():

 * Return a Session API ID corresponding to the current session.
 * The session id is a created using the same method as Drupal core
 * as defined in includes/session.inc.
 * @param boolean create set this to FALSE if you don't want to create a session
 * cookie if it doesn't already exist.
function session_api_get_sid($create = TRUE) {
  • 1
    This is all correct, except that %my_sid would not work with Drupal 7. +1 for suggesting to use the appropriate API the module exposes to the other modules.
    – apaderno
    Commented Jan 11, 2013 at 17:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.