79799539

Date: 2025-10-25 13:50:15
Score: 0.5
Natty:
Report link

The issue is quote nesting conflict. When you write:

$mysql_conn "prepare stmnt from '${sql}'..."

And ${sql} contains 'entry ', the single quotes inside clash with the outer statement's quotes.

Best solutions:

  1. Use double quotes in the PREPARE statement (Solution 1):

    $mysql_conn "prepare stmnt from \"${sql}\"; ..."
    
  2. Use a heredoc (Solution 2) - cleanest approach:

$mysql_conn <<EOF
prepare stmnt from "select concat('entry ', id) from mytbl where id = ?";
set @id='${entry}';
execute stmnt using @id;
deallocate prepare stmnt;
EOF
  1. Escape the inner single quotes (Solution 3):

    sql="select concat(\'entry \', id) from mytbl where id = ?"
    
Reasons:
  • Long answer (-0.5):
  • Has code block (-0.5):
  • Unregistered user (0.5):
  • Low reputation (1):
Posted by: katxarra