title: php sql trying to pass username variable to sql array
body: <p>Apologies as I am not very good with PHP and SQL.  I have a username which seems to work ok as I can echo it and that is correct. This is demonstrated below.</p>
  
  <p>
  
  <pre><code>  echo 'Username: ' . $current_user-&gt;user_login . "\n";
    echo 'User email: ' . $current_user-&gt;user_email . "\n";
    echo 'User first name: ' . $current_user-&gt;user_firstname . "\n";
    echo 'User last name: ' . $current_user-&gt;user_lastname . "\n";
    echo 'User display name: ' . $current_user-&gt;display_name . "\n";
    echo 'User ID: ' . $current_user-&gt;ID . "\n";
  </code></pre>
  
  <p>?></p>
  
  <p>This works fine.</p>
  
  <p>I have a function in a class. I thought that I could just pass a SQL statement where username is equal to this variable as shown below. However this does not seem to work.</p>
  
  <pre><code>protected function _scandir($id) {
          $files = array();
          $sql   = 'SELECT f.id, f.parent_id, f.name, f.size, f.mtime, f.mime, f.width, f.height, f.username, ch.id AS dirs 
                  WHERE f.username = $username
                  FROM '.$this-&gt;tbf.' AS f 
                  LEFT JOIN '.$this-&gt;tbf.' AS ch ON ch.parent_id=f.id 
                  AND f.parent_id="'.$id.'"
                  GROUP BY f.id';
  
          if ($res = $this-&gt;query($sql)) {
              while ($r = $res-&gt;fetch_assoc()) {
                  $id = $r['id'];
                  $this-&gt;stat($id, false, $r);
                  $files[] = $id;
              }
          }
          return $files;
      }
  </code></pre>
  
  <p>Am I missing something stupid or obvious here. I just need to pass the username variable and use this to query the database.</p>
  
  <p>This was the original query
  $</p>
  
  <p>protected function _scandir($id) {
          $files = array();
          $sql   = 'SELECT f.id, f.parent_id, f.name, f.size, f.mtime, f.mime, f.width, f.height, f.username, ch.id AS dirs 
                  FROM '.$this->tbf.' AS f 
                  LEFT JOIN '.$this->tbf.' AS ch ON ch.parent_id=f.id 
                  WHERE f.parent_id="'.$id.'"
                  AND f.username ="'.$username.'"
                  GROUP BY f.id';</p>
  
  <pre><code>    if ($res = $this-&gt;query($sql)) {
          while ($r = $res-&gt;fetch_assoc()) {
              $id = $r['id'];
  
              $this-&gt;stat($id, false, $r);
              $files[] = $id;
          }
      }
  
      return $files;
  }
  </code></pre>