RE: [PHP-DB] SQL statement

First off - $_POST['CompanyName'] is valid, right? Can you do something like this?: if (isset($_POST['CompanyName'])){ $sqlCompanyName = $_POST['CompanyName']; } else { "return them back to the form, or something?" } $query_company_listing = "SELECT CompanyID, CompanyName, CompanyOrDepartment, BillingAddress, City, PostalCode, PhoneNumber FROM company WHERE company.CompanyName='$sqlCompanyName' ORDER BY CompanyName ASC"; Also, what datatype is CompanyName? If it is varchar - or really anything else - I have had better look single quote encapsulation on the VALUE portion of the query (company.CompanyName='VALUE' vs. company.CompanyName=VALUE) Not knowing the datatypes may make this an irrelevant point though. -----Original Message----- From: PHPDiscuss - PHP Newsgroups and mailing lists [mailto:jdiazkropman@hotmail.com] Sent: Thursday, January 06, 2005 12:09 PM To: php-db@lists.php.net Subject: [PHP-DB] SQL statement Hello everybody, I'm building a small application and I have trouble passing a POST variable form one page to another inside the SQL statement. The query displayed below works great without the ".$_POST['CompanyName']." $query_company_listing = "SELECT CompanyID, CompanyName, CompanyOrDepartment, BillingAddress, City, PostalCode, PhoneNumber FROM company WHERE company.CompanyName=".$_POST['CompanyName']." ORDER BY CompanyName ASC"; But it messes up if I include it because the first " is considered as the end of the previous one and so on, so the code gets messed up. I'll really appreciate any/all help! Have you all an excellent year! Jorge -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php -- No virus found in this incoming message. Checked by AVG Anti-Virus. Version: 7.0.298 / Virus Database: 265.6.8 - Release Date: 1/3/2005 -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.298 / Virus Database: 265.6.8 - Release Date: 1/3/2005