如何在SQL select语句中使用php变量

I want to get some data from sql server using php but the sql doesn't seem reading the php variable

<?php
$q = $_POST["fl"];
echo $foo;
if ($_POST["fl"] == true);
{
$conn1=odbc_connect('SQLDB','','');
if (!$conn1)
{exit("Connection Failed: " . $conn1);}

 $sql1= "SELECT * FROM dbo.Audit WHERE Details = '$q'";
 $rs1=odbc_exec($conn1,$sql1);
 if (!$rs1)
 {exit("Error in SQL");}
while (odbc_fetch_row($rs1))

First things first, please sanitize the post before you put it inside an SQL query. You have to use htmlentities or even better, PDO.

Second, you can try this if your current one doesn't work:

$sql1 = "SELECT * FROM dbo.Audit WHERE Details = '".$q."'";

The best way to do that is:

$stmt    = odbc_prepare($conn1, "SELECT * FROM dbo.Audit WHERE Details = ?");
$success = odbc_execute($stmt, array(PDO::quote($_POST["fl"])));

You're testing for the presence of your $q incorrectly. You should have something more like:

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
   if (isset($_POST['fl'])) {
        $q = $_POST['fl'];
        $sql = "SELECT ... WHERE Details = '$q'":
        etc..
   } else {
       die("No fl value was passed");
   }
}

Also note that I have not corrected your SQL injection vulnerability. Your code, even if it was working, is just begging to get your database trashed.

To avoid the apparent downvote party I'm not going to post any SQL, but yadda yadda SQL injection, yadda yadda input validation, etc.

Your problem is:

if ($_POST["fl"] == true); //<-- this semicolon, get rid of it
{
$conn1=odbc_connect('SQLDB','','');

Aside from that your code is syntactically fine, though you should be using if(isset($_POST['f1'])) in place of if ($_POST["fl"] == true).

You can use PDO object for making a select query to the database....

$q = $_POST['fl'];
$pdo=new PDO('mysql:host=localhost;dbname=databasename','username','password');
$query="select * from dbo.Audit WHERE Details = :q;";
$result=$pdo->prepare($query);
$result->bindValue(':q',$q);
$result->execute();