C++ and sql SELECT statement - c++

Question

I have a quick question. I'm new in terms of trying to combine both sql and c++ together. My question is when I enter in the author to look for in the database, it say unknown column 'insert author last name here'. It's because of the input variable 'AuthorLast' not having quotes in the select statement. Thing is, I don't know how to fix it or change it.
#include<mysql.h>
#include<string>
#include<iostream>
using namespace std;
int main()
{
string AuthorLast;
mysql_library_init(0, NULL, NULL);
MYSQL* con = mysql_init(NULL);
if (con == NULL)
{
cout << mysql_error(con);
exit(1);
}
if (mysql_real_connect(con, "Insert Host here", "Insert ID here", "Password", "DataBase here", 0, NULL, 0) == NULL)
{
cout << mysql_error(con);
exit(1);
}
cout << "Enter in an author from the database: ";
getline(cin, AuthorLast);
string sql;
sql = "SELECT AuthorLast FROM Author WHERE AuthorLast= " + AuthorLast + ";";
const char* C = sql.c_str();
mysql_query(con, C);
MYSQL_RES* result = mysql_store_result(con);
if (result == NULL)
{
cout << mysql_error(con);
exit(1);
}
int field_nums = mysql_num_fields(result);
MYSQL_ROW row;
while (row = mysql_fetch_row(result))
{
for (int i = 0; i < field_nums; i++)
cout << row[i] << endl;
}
mysql_free_result(result);
mysql_close(con);
}

Answer 1

As other people have said, just adding single quotes in the SQL text would do the trick, but that leaves you vulnerable to SQL injection. Imagine that someone asks for an author name (written in another line for clarity):
SomeAuthor' or ''='
That would result in:
SELECT AuthorLast FROM Author WHERE AuthorLast= 'SomeAuthor' or ''='';
Which would result in your query returning all of the last names of authors. Although this may seem irrelevant for you, if (for example) you use the same approach in a password checking query, it can lead to an attacker being able to login without knowing the user password (in essence, you are allowing the user to modify your query).
You should thoroughly sanitize the user's input (this is, ensuring that it does not include unexpected characters) before including it in the query or (better still) use prepared statements (for mysql, I think that you can take a look at the mysql_stmt_* methods).
Prepared statements are more or less like telling the database server to execute "SELECT AuthorLast FROM Author WHERE AuthorLast=?", and telling it to use "MyAuthorLast" in place of the ?. So if someone tries to include quotes in the name, the server automatically sanitizes the input for you by adding any required escape characters.