Re: security benefits of predefined variables

> You can see where I'm going with this. > Experiments of mine with using array elements within SQL statements > brought some of my questioning to the list just last week. I found that > the following did not work: > > $sql = "SELECT table.column FROM table WHERE criteria LIKE > $myrow['variable']"; Inside a quoted string you don't use the single-quotes around the index. So this would work: $sql = "SELECT table.column FROM table WHERE criteria LIKE $myrow[variable]"; My preferred method is to use: $sql = "SELECT table.column FROM table WHERE criteria LIKE " . $myrow['variable']; -Rasmus