Title: Using a Drupal variable in SQL query
Tags: php;drupal
Question: I'm trying to stuff a variable into a SQL query to return a value to a page.

```$sql = 'SELECT account FROM users WHERE uid = arg(1)';
```

Where arg(1) = the user currently being viewed. I am outputting arg(1) at the top of the page, so I know it's there, but Drupal doesn't seem to want to take it. I've tried escaping several different ways. Below is the full code

```  function accountselect_getclientaccount() {
      global $user;
      $sql = 'SELECT account FROM users WHERE uid = arg(1)';
      $result = db_result(db_query($sql));
    return $result;
  }
```


Here is the accepted answer: You could try:

```$uid = arg(1);
$result = db_result(db_query("SELECT account FROM {users} WHERE uid = %d", $uid));
```


Here is another answer: To avoid sql-injection, you should use placeholders (see db_query for more info):

```$result = db_query("SELECT * FROM {users} WHERE uid = %d", arg(1));
```

Also note that db_result is meant for single-column, single-result queries. You probably want to use db_fetch_object. Additionally, there isn't a column in the users table called account.

Comment for this answer: Thanks, jhedstrom - isn't the solution provided by anonymouse the same in terms of SQL injection attacks...?

By the way, I am only trying to grab one value, and I have created a column named `account`. I know that's like pissing on the Drupal bible, but for the specific situation I wanted to use it for, it needed to go that way. Besides, I'm betting that the User table doesn't change that much...
Comment for this answer: It is the same as anonymouse's...I think we cross-posted those answers.

Here is another answer: ```function accountselect_getclientaccount() {
  return (arg(0) == 'user') ? db_result(db_query('SELECT account FROM {users} WHERE uid = %d', arg(1))) : FALSE;
  }
```

I don't know why you're using the global $user. Maybe you should be using $user->uid instead of arg(1)? This would save you checking arg(1) is actually a user ID. 

This might be better:

```function accountselect_getclientaccount($account) {
  return db_result(db_query('SELECT account FROM {users} WHERE uid = %d', $account-&gt;uid));
  }
```

Also: see the user hook. It might be best practice to return the 'account' col on the load operation (if you're not doing that already) 

http://api.drupal.org/api/function/hook_user/6

Comment for this answer: You're right, I didn't need global $user in the code. I removed it shortly after. As far as the $user->uid, that returns the uid of the currently logged in user. arg(1) returns the uid of the user whose account you are viewing. 

The purpose of the function is to load the users current account as default value in the select list. It was sort of a pain. What is 'load' operation? A user-edit state?
Comment for this answer: Edit is another state but you're kinda right. You would have loaded that account from that URL so you could write something like:

function mymodule_user($op, &$edit, &$account, $category) {
  if($op == 'load') {
    //do something to $account
  }
}

It shouldn't be too hard if you hook into the API the right way :)

{'source': 'StackExchangeDataset', 'subset': 'stackoverflow.com', 'metadata': {'AnswerCount': 3, 'CommentCount': 0, 'ContentLicense': 'CC BY-SA 2.5', 'CreationDate': '2009:00:12/16/09', 'FavoriteCount': None, 'PostTypeId': 1, 'Tags': '<php><drupal>', 'Title': 'Using a Drupal variable in SQL query', 'ViewCount': 3612, 'id': 1917975, 'user_AboutMe': '<p>Codemonkey...</p>\n', 'user_AccountId': 210607.0, 'user_DisplayName': 'tpow', 'user_Reputation': 7402.0, 'user_Views': 517.0, 'user_id': 462307.0}}