PHP string variable in WHERE clause MySQL

Question

I am having a problem with this simple sql query:

Answer 1

you getting no date because you have extra space betwee the quotes,

$query_getShows = "SELECT * FROM toho_shows WHERE toho_shows.show =' ". $show. " '";
                                                                    ^ HERE      ^

which will then be parsed into

SELECT * FROM toho_shows WHERE toho_shows.show =' gothaf '

---

remove it and it will work

$query_getShows = "SELECT * FROM toho_shows WHERE toho_shows.show ='". $show. "'";

As a sidenote, the query is vulnerable with SQL Injection if the value(s) of the variables came from the outside. Please take a look at the article below to learn how to prevent from it. By using PreparedStatements you can get rid of using single quotes around values.

• How to prevent SQL injection in PHP?