Error: mysql_fetch_assoc inside Function

Question

function retornaStatusPesquisa($numeroStatus,$nomePessoa, $nomeTabela){
    $query = mysql_query("SELECT COUNT(status) AS valorStatus FROM $nomeTabela WHERE status=$numeroStatus AND nomePessoa='$nomePessoa'");
    $contador=mysql_fetch_assoc($query);
    return $contador;
}

I’m getting this mistake:

You have an error in your SQL syntax; check the manual that Corresponds to your Mysql server version for the right syntax to use near 'WHERE status=1 AND namePessoa='Joao'' at line 1

It’s probably because of $nomeTabela, I don’t know why this happens, could give a light?

Answer 1

Is there a possibility that you or someone is passing the $nomePessoa with a single quotation mark, example João', and this ends up breaking the logic of its concatenation of parameters in addition to opening security gaps.

Prefer to pass the parameters through the bindValue, more information here: How to prevent SQL code injection into my PHP code

Another source that can help you move your project to PDO: http://www.thedevfiles.com/2014/08/moving-from-mysql-query-to-pdo/