MySQL query based on user input in c - mysql

Question

how to take input from user in c and use this input in where clause of mysql statement
int main(){
char *input;
scanf("%s",input);
mysql_quer(con,"select * from < tablename > where < column > = input ");
}

Answer 1

char *input;
scanf("%s",input);
This is a problem. input is just a pointer to somewhere, it's not an actual buffer that can store input, and it's not automatically pointing anywhere meaningful. You should set aside a buffer to store your input:
#define BUFFER_SIZE 20 // or however big you need your buffer to be
...
char input[BUFFER_SIZE + 1];
if ( fgets( input, sizeof input, stdin ) )
{
/**
* fgets doesn't strip the trailing newline
*/
char *newline = strchr( input, '\n' );
if ( newline )
*newline = 0;
// use input
}
else
{
// error or EOF on input
}
scanf is not a great tool for interactive input, and the %s conversion specifier opens the same security hole that gets used to - if the user types in more characters than the buffer is sized to hold, then C will happily store those extra characters to the memory following the buffer, potentially clobbering something important.
If your heart is set on using scanf, then you need to provide an explicit maximum input size as part of the %s specifier, like %20s. Unfortunately, such maximum input sizes must be hardcoded in the format; scanf doesn't have a way for you to provide it as an argument the way printf does. You can use the following nonsense to work around it:
#define BUFFER_SIZE 20
#define STR(x) #x
#define FMT(len) "%" STR(len) "s"
...
scanf( FMT(BUFFER_SIZE), input );
It's just easier to use fgets (and fgets allows for blank spaces in the input, whereas the %s conversion specifier will stop reading after the first whitespace character). Tradeoff is that you have to handle the trailing newline.
mysql_quer(con,"select * from where = input ");
You never want to pass user input directly to a SQL statement; see the parable of little Bobby Tables for why. You'll want to do some sanity checking on your inputs (make sure there are no ';' or ''' characters at least). Although it's a bit of work, you'd probably want to use a prepared statement - here's an example.

Answer 2

Use sprintf() to insert the input variable into the SQL string. And the value has to be in quotes if it's a string. Also, you never allocated space for input.
char input[BUFSIZ];
char sql[BUFSIZ];
scanf("%s", input);
sprintf(sql, "select * from tablename where column = '%s' ", input);
mysql_query(con, sql);