Search code examples
phpmysqleval

SQL sentence get from table，have variable in sentence，can't execute

I have a table save some sql sentence.

For example：

value:`select * from table where aa='".$test."'`

 <?php
      $test="bbb";
      $strsql=$row["sql"]; 
      echo $strsql;
      //result is :select * from table where aa='".$test."'
 ?>

but I want: select * from table where aa='bbb'

help me thanks!!

Solution

  • You should used explode function like

    $test="bbb";
$data=explode("=",$strsql);
$new_query=$data[0]."='$test'"

    You can used eval() function but i suppose you are new coder and eval() function is very dangerous.

    As per PHP Manual

    Caution The eval() language construct is very dangerous because it allows execution of arbitrary PHP code. Its use thus is discouraged. If you have carefully verified that there is no other option than to use this construct, pay special attention not to pass any user provided data into it without properly validating it beforehand.