mysql 获取输入查询,基于用户输入的MySQL查询

I have a DB table. I want to make a text input where the user can input the "uid" and the query will return the row associated with that uid.

So let's say I have something like this:

$query = "SELECT name,age FROM people WHERE uid = '2' LIMIT 0,1";

$result = mysql_query($query);

$res = mysql_fetch_assoc($result);

echo $res["age"];

how would I modify that query to something like..

SELECT name, age

FROM people

WHERE uid = $_POST['blahblah'] LIMIT 0,1

Thanks in advance for your help!

解决方案

To save from SQL injection attack, use:

$search_query = mysql_real_escape_string($_POST['blahblah']);

$query = "SELECT name, age FROM people WHERE uid = '".$search_query."' LIMIT 0 , 1";