Question: Are two following syntax equal?

```
#1
var option_1 = 0;
var option_2 = 0;

#2
var option_1 = 0, option_2;

```

I've recently came across to the syntax shown in #2 while didn't get it completely. Is it a short way of variable declaration of #1? 

Thank you in advance.

Answer: 
You'd take:

```
$query = "SELECT * FROM students WHERE SID = $id_in AND name = $name_in;";

```

And make it into prepared statements:

```
$db = new mysqli(...); //Look up the connection if you don't already home one.
$stmnt = $db->prepare("select a, b, c from students where sid = ? and name = ?");
$stmnt->bind_param('is',$id_in,$name_in);
$stmnt->execute();
$stmnt->bind_result($a,$b,$c);
while($stmtnt->fetch())
{
  // Do stuff with $a $b and $c
}

```

The question marks in the query statement stands for "something from the user goes here we don't trust". The first parameter to the `bind_param` function tell mysqli the types of each of the following parameters. In this case a int (`i`) and string (`s`) are used for id and the student name. But you should sanitize and validate your input even before you get to the query using input filters and whitelists/regexes. Note that we also ask for exactly the fields we want, and don't use \* in the select. This is important because we need to match those to variables in the call to `bind_results()`.
I believe you would like to do this

`$query = "SELECT * FROM students WHERE SID = $id_in AND name = '$name_in'";`

Text variables passed in SQL must be wrapped in quotes. 

If the user adds "quotes" to their name. You must strip it, using database escape function when passing variables directly into SQL. <http://php.net/manual/en/mysqli.real-escape-string.php>

You would add this to your variable.  

`$name_in = $mysqli->real_escape_string(trim($_POST['name_in']));`