Syntax Error line 0, col 83: Error: Expected end of string, got 'cbfde50'

Question

The following is my class with the method:

class BidsInfoRepository extends EntityRepository
{
     public function findbidWinnerQuery($productId) {
              return $this->getEntityManager()
                        ->createQuery("SELECT w FROM ReverseAuctionReverseAuctionBundle:BidsInfo w where w.ProductInfo = ***$productId*** GROUP BY w.bAmount HAVING COUNT(w) = 1")
                        ->setMaxResults(1)     
                        ->getResult() 
                ;
    }
}

The variable $productId has the following format value separated with hyphen: 5cbfde50-50b9-11e5-9612-752c7cea21e5 ,

Obviously it doesn't like that format in fact 'cbdfe50' is included in the string separated with hyphen and for some reason I think the hyphen stops the process, but I don't know how to let the mysql to process the long string separated with hyphen instead of returning the error mentioned on my issue title. Any idea? Thanks.

p.s. I've also tried using "like '$productId'" but it won't work.

score 1 · Answer 1 · answered Sep 02 '15 at 10:52

1

You simply forgot the quotes:

"SELECT w FROM ReverseAuctionReverseAuctionBundle:BidsInfo w where w.ProductInfo = '5cbfde50-50b9-11e5-9612-752c7cea21e5' GROUP BY w.bAmount HAVING COUNT(w) = 1"

Also keep in mind that you should properly escape strings in sql queries in order to avoid sql injection.

answered Sep 02 '15 at 10:52

Lorenz Meyer

19,166
22
75
121

Yeah, use `->createQuery('..... :productId ...')->setParameter('productId', $productId)` to escape. – qooplmao Sep 02 '15 at 11:16
just forget escaping completely and use prepared parameters. this way, you're almost 100% protected from sql injection. – Joshua Sep 02 '15 at 12:37
Thanks to all for the suggestions ;-) – armslegs Sep 03 '15 at 05:42

Syntax Error line 0, col 83: Error: Expected end of string, got 'cbfde50'

1 Answers1