sending variable to function to execute odbc SELECT
I am trying to execute the function below but does not display anything.
function displayNr($x){
$sql="SELECT D4741 FROM table_x WHERE D4711='".$x."';
if (!$result = odbc_exec($pconn, $sql)) {
echo "Query error! ODBC: ", odbc_error();
} else {
while ($row = odbc_fetch_array($result)) {
echo $row["D4741"] . "\n";
}
}
}
displayNr('name');
However, if I remove the function it works correctly:
x='name';
$sql="SELECT D4741 FROM table_x WHERE D4711='".$开发者_JAVA技巧x."';
if (!$result = odbc_exec($pconn, $sql)) {
echo "Query error! ODBC: ", odbc_error();
} else {
while ($row = odbc_fetch_array($result)) {
echo $row["D4741"] . "\n";
}
}
What could be the problem?
$pconn is not set in the function.
in the function, $pconn is a new local variable (with a scope of the function) and is not the same $pconn defined outside the function. pass it in as a parameter:
function displayNr($x,$pconn){
$sql="SELECT D4741 FROM table_x WHERE D4711='".$x."';
if (!$result = odbc_exec($pconn, $sql)) {
echo "Query error! ODBC: ", odbc_error();
} else {
while ($row = odbc_fetch_array($result)) {
echo $row["D4741"] . "\n";
}
}
}
displayNr('name');
watch out for SQL injection!!! your code is a perfect example of what not to do!!:
$sql="SELECT D4741 FROM table_x WHERE D4711='".$x."';
see this: SQL Injection or just google it
function displayNr($x, $pconn)
{
$sql = "SELECT D4741 FROM table_x WHERE D4711='" . $x . "'"; //here " is remaining
if (!$result = odbc_exec($pconn, $sql)) {
echo "Query error! ODBC: ", odbc_error();
} else {
while ($row = odbc_fetch_array($result)) {
echo $row["D4741"] . "\n";
}
}
}
displayNr('name');
精彩评论