Safe, Simple, SQL statement

[Dankinit]

After reading about sql injection methods on various sites and proper coding techniques from the new vb3 manual, I'm looking over all my code before launching next vb3 version of my site.

What's the proper way to write this statement? As it stands, it doesn't work. I know it's the way i'm using quotes around $letter variable, just wondering the "proper" and safe way to access this. Thanks for any help

PHP Code:

    $letterlisting = $DB_site->query("
        SELECT ID,Artist 
        FROM music 
        WHERE Artist LIKE '" . $letter . "'
        GROUP BY Artist 
        ORDER BY Artist;
    "); 


[Xenon]

you have to use parameters when you're using LIKE:

WHERE Artist LIKE '" . $letter . "%'

[Dankinit]

Thanks, after all that rework i did, i forgot the important "%"! No wonder it wasn't working Thanks Xenon.

[filburt1]

Always wrap any string variable with addslashes() and numeric values with intval() when using them in queries.

[Xenon]

Originally Posted by Dankinit

Thanks, after all that rework i did, i forgot the important "%"! No wonder it wasn't working Thanks Xenon.

you're welcome