dynamic SQL built in a PHP form - problem with character values

[jej1216]

I have a multi-field search PHP page, and the resulting PHP page builds dynamic WHERE statements to do the database search. The first field is numeric, and works:

$facility = $_REQUEST['fac_id'];
if ($facility != '') {
echo "Facility: ".$facility." ";
$where .= ' AND fac_id='.$facility.'';
}
 

This code builds SQL that looks like this:
SELECT fac_id, room_descr, person_type, severity FROM incidents WHERE 1=1 AND fac_id=000852 ORDER BY fac_id, room_descr, person_type, severity.
But when the field is character, this same code does not work:

$persontype = $_REQUEST['person_type'];
if ($persontype != '') {
echo "Persontype: ".$persontype. " ";
$where .= ' AND person_type ='.$persontype.'';
}
 

This produces the following SQL:
SELECT fac_id, room_descr, person_type, severity FROM incidents WHERE 1=1 AND person_type =Outpatient ORDER BY fac_id, room_descr, person_type, severity
And gives the error:
Error: Unknown column 'Outpatient' in 'where clause'.
If I copy the SQL produced and add quotes around Outpatient it runs fine in phpmyadmin.

How do I add single quotes to the person_type field?

TIA,

jej1216

[jej1216]

I got it.

$persontype = $_REQUEST['person_type'];
if ($persontype != '') {
echo "Persontype: ".$persontype. " ";
$where .= " AND person_type ='".$persontype."'";
}
 

I knew it was a small thing.

jej1216

[pbmods]

Good thinking.

One thing I must caution you about, though: What if $_REQUEST['person_type'] were "'\cDROP TABLE `incidents`"?

http://us2.php.net/addslashes