Use variable in SQL statement

Question

I have this:

<?php
$jerseys = $wpdb->get_results("SELECT order_item_id, order_id FROM wp_woocommerce_order_items WHERE order_item_name = 'Mystery Jersey'");
echo "<p>Jerseys</p>";
if ( $jerseys )
{
    foreach ( $jerseys as $post )
    {   
        $orderID = $post->order_id;
        $size = $wpdb->get_results("SELECT meta_value FROM wp_woocommerce_order_itemmeta WHERE meta_key = '_wc_checkout_add_on_label' AND order_item_id = '" . echo $orderID . "'");
        echo '<p>' ;
        //var_dump($post[$i]); 
        print_r($size);
        echo $orderID;
        echo $size->meta_value;
        $i++;
        echo '</p>';
    }   
}
?>

I have 2 tables I am trying to get information from, one of them dependent on the other. The $jerseys statement is getting all orders from a custom table of the 'Mystery Jersey' type. Ten the $size statement is trying to get the size of those jerseys, from a separate table. I think pretty much everything works except for the part where I am trying to get a query based on a previous query.

Answer 1

Firstly, as a PHP rule, you don't need to echo a variable when doing a string concatenation.

Secondly, you need to prepare your query when adding a variable inside.

So your query would become like this:

$prepared = $wpdb->prepare(
  "SELECT meta_value FROM wp_woocommerce_order_itemmeta WHERE meta_key = '_wc_checkout_add_on_label' AND order_item_id = %s",
  $orderID
);
$size = $wpdb->get_results( $prepared );