PHPフォーム処理POST

Question

フォーム処理を使用して特定のデータベースクエリを作成しようとしています。 $ nameにフォームを設定し、$ sql = "SELECT * FROM quotes where qSymbol = $ name ORDER BY qQuoteDateTime DESC"を処理しようとしています。 これを行うにはどうすればよいでしょうか？

<form action="post.php" method="post"> 
<span></span><input type = "text" value=" " name="boxy" /> 
<br/><input type="submit" name="submit" value="Enter" /> 
</form> 

<?php 
    $name = $_POST['boxy']; 
    if(isset($_POST['boxy'])){ 
     error_reporting(E_ALL^E_DEPRECATED); 

     $con = mysql_connect('...'); 
     if (!$con){ 
      die("Cannot connect : " . mysql_error()); 
     } 
     mysql_select_db('quotesdb',$con); 
     $sql = "SELECT * FROM quotes WHERE qSymbol = '$name' ORDER BY qQuoteDateTime DESC"; 
     $myData = mysql_query($sql,$con); 
     echo "<table border = 1> 
     <tr> 
     <th>Data</th> 
     <th>Last</th> 
     <th>Change</th> 
     <th>% Chg</th> 
     <th>Volume</th> 
     </tr>"; 

     while ($record = mysql_fetch_array($myData)){ 
      echo "<tr>"; 
      echo "<td>" . $record['qQuoteDateTime'] . "</td>"; 
      echo "<td>" . $record['qLastSalePrice'] . "</td>"; 
      echo "<td>" . $record['qNetChangePrice'] . "</td>"; 
      echo "<td>" . $record['qNetChangePct'] . "</td>"; 
      echo "<td>" . $record['qShareVolumeQty'] . "</td>"; 
      echo "</tr>"; 

     echo "</table>"; 



     mysql_close($con); 




     } 

Answer 1

それは数

$sql = "SELECT * FROM quotes WHERE qSymbol = '$name' ORDER BY qQuoteDateTime DESC";