PHP Error in MySQL Syntax

Question

Here's the function I created:

function get_phurl_option($option) {
$db_result = mysql_query("SELECT value FROM ".DB_PREFIX."options WHERE option = '$option'") or db_die(__FILE__, __LINE__, mysql_error());
$db_row = mysql_fetch_row($db_result);
return $db_row[0];
}

However, upon visiting a page that uses the function, I get the following error:

File: /usr/home/<removed>/includes/functions.php
Line: 28
Message: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'option = 'shortcode_type'' at line 1

I'm not sure why this would be, I've tried apostrophes, speech marks, and backticks, neither of which seem to work. I can't figure out the problem here, so any help would be much appreciated.

• F.P: Escape your variables correctly, it will save you lots of errors and nerves.
• Ahatius: What does $option look like? The query itself looks fine, assuming DB_PREFIX is set
• Lix: Echo out the final query before executing it... That will allow you to see exactly where the problem is...
• tereško: Please don't use mysql_* functions in new code. They were removed from PHP 7.0.0 in 2015. Instead, use prepared statements via PDO or MySQLi. See Why shouldn't I use mysql_* functions in PHP? for more information.

Answer 1

option is a MySQL reserved word, so you need to enclose it in backticks

$db_result = mysql_query("SELECT value FROM ".DB_PREFIX."options WHERE `option` = '$option'")

Answer 2

The specified error usually means that the field you're attempting to access is invalid or reserved by MySQL. Make sure you escape all variables in backticks:

SELECT `value` FROM `".DB_PREFIX."options` WHERE `option` = '$option'