Query returns null

Question

Hello I've got this query to get users by email, which is an unique field in the db.

However, when i want to get the data on it, it simply returns null.

Here's the code

    public function getUserByEmail($email)
    {

            $statement = "SELECT id_user,nome,email,permissao,activo FROM sys_users 
                          WHERE email=$email";

            try
            {

             $sth = $this->db->query($statement);
             $sth->setFetchMode(PDO::FETCH_OBJ);
             $rcs_users = $sth->fetchAll();
             return $rcs_users;

            }
            catch(PDOException $e)
            {
                "DB Error".$e->getMessage();
            }

    }

And the respective function call

$user_rcs = $user->getUserByEmail($email);

    var_dump($user_rcs); //returns null




    $_SESSION['email'] = $email;
    $_SESSION['user'] = $user_rcs->nome;
    $_SESSION['permissao'] = $user_rcs->permissao;

And then I get this error

Notice: Trying to get property of non-object in C:\xampp\htdocs\inacesso\admin\modules\auth\authhandler.php on line 24

Glad if you could help me!

Watch out, you need to add quotes to your sql query strings. — Ryan, Jun 14 '12 at 15:04
So how do you recomend me to escape data? You just see a part of the script but I'm using mysql_real_escap_string on posted data (email,etc). Is there a better way using PDO? — João Dias, Jun 14 '12 at 15:15

score 5 · Answer 1 · edited May 23 '17 at 12:29

5

Strings in SQL have to be quoted, so unless $email arrives in the function with ' and ' around it, the SQL will error.

But you shouldn't be building SQL by mashing together PHP strings anyway. Use PDO or mysqli_* with bound parameters (and prepared statements) and that will take care of quoting (and escaping) for you.

edited May 23 '17 at 12:29

Community

1
1

answered Jun 14 '12 at 15:03

Quentin

914,110
126
1,211
1,335

How can I use pure PDO to do as such? Can you give me an example? – João Dias Jun 14 '12 at 15:12

Brad Christie · Accepted Answer · 2012-06-14T15:31:50.253

1

First off, seriously have a look at PDO.

Secondly I would imagine the email column is a string. As such, you'll need to surround $email with quotes in your query (after having sanitized it vigorously of course...)

WHERE email='$email'

PDO version:

$pdo = new PDO(...);
$query = $pdo->prepare('SELECT id_user,nome,email,permissao,activo '.
                       'FROM   sys_users '.
                       'WHERE  email = ?');
$result = $query->execute(array($email));

edited Jun 14 '12 at 15:31

answered Jun 14 '12 at 15:04

Brad Christie

100,477
16
156
200

Depends on perspective; I consider it _sanitized_ if SQL isn't going to have trouble accepting and parsing it. (Cleaned up from any injections or malformed input). – Brad Christie Jun 14 '12 at 15:09
I usually do as such to Insert in the db. I'll use it this way from now on. Thanks!! – João Dias Jun 14 '12 at 15:18

Query returns null

2 Answers2

PDO version: