Connecting PHP to MS SQL Server

Question

<?php
$serverName = "(local)"; //serverName
$connectionInfo = array( "Database"=>"DabaseNew", "UID"=>"sa", "PWD"=>"*****");
$conn = sqlsrv_connect( $serverName, $connectionInfo);
if( $conn==true ) {
    echo "Connection established.<br />";
}else{
    echo "Connection could not be established.<br />";
    die( print_r( sqlsrv_errors(), true));
}
$sql = "SELECT * FROM Dbo.DATABASE COMPANY SERVICES$Employee";
$stmt = sqlsrv_query( $conn, $sql);
if(!$stmt){
    die( print_r( sqlsrv_errors(), true));
}
$rows = sqlsrv_has_rows($stmt);
while($obj = sqlsrv_fetch_object( $stmt)){
    echo $obj->Description.", ".$obj->lName."<br />";
}
?>

I am trying to connect to php to my sql server using sqlsrv_connect. The above code gives me an error below;

Output: Connection established. Array ( [0] => Array ( [0] => 42000 [SQLSTATE] => 42000 [1] => 102 [code] => 102 [2] => [Microsoft][SQL Server Native Client 11.0][SQL Server]Incorrect syntax near 'SERVICES'. [message] => [Microsoft][SQL Server Native Client 11.0][SQL Server]Incorrect syntax near 'SERVICES'. ) )

Answer 1

If there are spaces in the tablename you should run the query like this: $sql = "SELECT * FROM dbo.[DATABASE COMPANY SERVICES]"; Not sure what you are trying to do with $employee, because php sees it as a variable and tries to paste fill it in there (I think here $employee being NULL).

Answer 2

Try to switch

$sql = "SELECT * FROM Dbo.DATABASE COMPANY SERVICES$Employee";

with

$sql = 'SELECT * FROM Dbo.[DATABASE COMPANY SERVICES$Employee]';

Because php thinks $Employee is a variable if you use double quotes. The [] is used to tell the database that the table name is DATABASE COMPANY SERVICES$Employee otherwise the space will indicate the start of another sql command or variable.

Try not to use spaces in table names btw, it avoids confusion.

Answer 3

You need to escape the $ character with \$, as php treats it as first character ov a variable. Try this:

$sql = "SELECT * FROM Dbo.[DATABASE COMPANY SERVICES\$Employee]";

---

EDIT:

To avoid escapingg you could also use single quotes ' instead of double quotes ". Then PHP does not resolve variables within the string. (see this question)

$sql = 'SELECT * FROM Dbo.[DATABASE COMPANY SERVICES$Employee]';

---

2nd EDIT:

To concatenate two strings use . operator like this:

$foo = "Hello ";
$bar = $foo."world!"; // gives "Hello world!"

As you can read within the answer linked within the first edit " double quotes resolve variables inbetween, while ' single quotes don't. your possible solution could be like this:

$query = 'SELECT [First Name] AS firstName, [Last Name] AS lastName
            FROM  Dbo.[DATABASE COMPANY SERVICES$Employee]
            WHERE [Employee Number] = 15 OR [E-Mail] = \''.mssql_escape($mail).'\'';

But you should NEVER directly send a GET parameter top your sql server. Anybody could infiltrate your database or even delete it. Therefore you should add a escape function like this one or consider using another db-library like PDO and build parameterized queries. It might me sufficient to escape single quotes within the variable with another single quote like this:

function mssql_escape($str) {
    return str_replace("'", "''", $str);
}