How to get MySQL select query values into a PHP variable? -

i know need use mysql fetch prevent getting resource id in variable wondered if me out how that. see several tutorials use loop want select 1 string variable. here code have:

$img = mysql_query('select pname photos pphotoid=21'); echo $img; 

i want $img contain string in database not resource id #3 showing. wrote prone sql injection?

learning mysql great!

$handle = mysql_query('select pname photos pphotoid=21'); $row = mysql_fetch_row($handle); echo $img[0]; 

http://pl1.php.net/mysql_fetch_row

this code work you.

to prevent sql injection should use escape functions mysql_escape_string() should check input , valid it

here learn more

how can prevent sql injection in php?

also it's better use pdo because mysql_* deprecated of php 5.5.0, , removed in future.

here tutorial learn connecting db pdo

http://wiki.hashphp.org/pdo_tutorial_for_mysql_developers

your code in pdo(assuming connected db) like: $id = intval(21); //this code here senseless if 21 example via $_get cast integer , prevent injection

$stmt = $db->prepare("select pname photos pphotoid=?"); $stmt->execute(array($id)); $row = $stmt->fetch(pdo::fetch_assoc); echo $row['pname'];