How to pass the value from the variable into the query

**marcofsportugal** · November 5th, 2013

[C Programming Language]

I've been try to perform the following query:

Code:

scanf("%32s", &user); (...)
if(mysql_query(conn,"SELECT password From user where username='admin'"))

//where you see 'admin' should be the value of the variable user

how to pass the value from the variable user into the query?
Ty guys!

**QIII** · November 5th, 2013

Moved to Programming Talk

**Bachstelze** · November 5th, 2013

1. Do not use scanf().
2. Essentially, you want something like

Code:

char query[SOME_SIZE];
sprintf(query, "SELECT password From user where username='%s'", user);
mysql_query(conn, query);

but you have some input sanitisation to do. Since I am not a MySQL expert, I will leave this to others.

**ofnuts** · November 6th, 2013

Use "prepared statements"?

**r-senior** · November 7th, 2013

Originally Posted by ofnuts

Use "prepared statements"?

+1

Concatenating strings to form queries means the database has to parse the SQL multiple times, which is an unnecessary overhead. With a prepared statement the query is parsed once and the variable is bound at execution time.

Here is an example in C/MySQL:

http://lgallardo.com/en/2011/06/23/s...mplo-completo/