Invalid identifier results from an sql statement in php

Question

hello there, i'm trying to access data from an oracle 11g database via oci and php 5.3.8.
i'm getting the ORA-00904 (invalid identifier) error when executing the following statement:
$stid = oci_parse($conn, 'select * from table1 where column1 = "XYZ"');
when i do this:
$searchstring = "XYZ";
$stid = oci_parse($conn, 'select * from table1 where column1 = '.$searchstring.'');
i'm getting this error:
ORA-00933: SQL command not properly ended
column1 is varchar2, the entries are either letters and numbers (never only numbers) or empty.
when i do this:
$stid = oci_parse($conn, 'select * from table1');
i'm getting the data and there are entries in column1 with XYZ.
has anyone an idea, what i do wrong?
regards j

Answer 1

The PHP forum for questions like this is at http://www.oracle.com/technetwork/forums/php/index.html
You really need to be using a bind variable here. Otherwise you will likely suffer from poor DB performance, and also open yourself to SQL Injection security attacks. Try:
$stid = oci_parse($conn, 'select * from table1 where column1 = :bv');
oci_bind_by_name($stid, ":bv", $searchstring);Regarding quoting of your example try:
$searchstring = "XYZ";
echo  'select * from table1 where column1 = '.$searchstring.'';Then run that SQL in SQL*Plus and watch it fail. What you need is given with:
echo  'select * from table1 where column1 = \''.$searchstring.'\'';See the bottom of p 126 of The Underground PHP and Oracle Manual
Note that with the bind variable example you didn't need quotes around :bv.