title: How should I write PHP $_POST vars in a mysql_query function?
body: <p>In accessing my database, I have the user fill out a form, and in the target page, the posted values are used in the resulting MySQL query.</p>
  
  <pre><code>$query = mysql_query("SELECT pass FROM database WHERE user='$_POST[user]'");
  </code></pre>
  
  <p>However, for some reason or another, MySQL doesn't like my using a $_POST variable in the command, and it only works if I define (for example) <code>$user = $_POST['user'];</code>, and then put $user directly in the SQL command.</p>
  
  <p>On the other hand, I can use $_POST values in INSERT statements where specific column names are not required:</p>
  
  <pre><code>$query = mysql_query("INSERT INTO database VALUES ('foo', 'bar', '$_POST[user]'");
  </code></pre>
  
  <p>If I try an INSERT statement where attributes are defined (e.g. <code>user='foo'</code>), then the same problem appears.</p>
  
  <p>What am I doing wrong in my SQL query that causes the command to error out when run, but works with the specific method of formatting an INSERT command?</p>
  
  <p>Hopefully, it's not "tough luck, looks like you have to assign all of your posted values". Heh.</p>