mysql_query Issue - Syntax error

Question

I'm currently building a web form which has several drop down menus and I want to submit these into a SQL database through PHP.

I have little PHP knowledge but no better way to learn than doing it! I'm following this guide to post data back to my db - Link

My code is:

$CLI = $_POST['CLI'];
$Environment = $_POST['Environment'];
$Type = $_POST['Type'];
$Fault = $_POST['Fault'];

$query="INSERT INTO testtable (cli, env, type, fault)VALUES ('$CLI', '$Environment', '$Type', '$Fault')"

mysql_query($query) or die (mysql_error());

echo "Database Updated With: ".$CLI";

When I'm editting this code I'm getting a syntax error on the mysql_query line and the echo line. I've uploaded this to my server however it goes to the php update page then doesnt post the data back to the db.

Can someone help please? I can't find any simple answers to fix it!

Thanks

Dreamweaver just points out I have a syntax error on lines:mysql_query($query) or die (mysql_error()); echo "Database Updated With: ".$CLI"; — user1634278
– user1634278, Commented Aug 29, 2012 at 20:13
1. you are asking to be hacked that way! 2. if you are getting a syntax error why don't you post the error?! also check if all the fields you listed exist in your db table and things like that. — SparK
– SparK, Commented Aug 29, 2012 at 20:14
Please do not use mysql_query in new applications. This interface is being phased out because of serious problems with SQL injection bugs as you've demonstrated in your simple example. If any of these values contain ' then your query will not work. You should be using mysqli or PDO and placeholders to do this correctly under all circumstances. — tadman
– tadman, Commented Aug 29, 2012 at 20:18

egrunin · Accepted Answer · 2012-08-29 20:19:17Z

4

You need a semicolon at the end of the mysql line (after the last quote).

Probably you need a space before VALUES.

You have an extra " at the end of the last line.

In other words:

$query="INSERT INTO testtable (cli, env, type, fault) VALUES ('$CLI', '$Environment', '$Type', '$Fault')";

mysql_query($query) or die (mysql_error());

echo "Database Updated With: ".$CLI;

NOTE:

As was mentioned in a comment, if someone invokes the page passing this:

&Type=','');+DROP+TABLE+testtable;+--

...it will delete your data! Please read up on "Sql injection attacks" before it's too late.

edited Aug 29, 2012 at 20:19

answered Aug 29, 2012 at 20:13

egrunin

25.2k8 gold badges53 silver badges96 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

SparK Over a year ago

assembling the query that way he is ought to be hacked soon, isn't he?

user1634278 Over a year ago

Thanks so much egrunin, that's sorted it :) I had too many "'s.

egrunin Over a year ago

@user1634278 - glad to be of help, I've added more to address SparK's very important point.

Grzegorz · Accepted Answer · 2012-08-29 20:14:11Z

1

Please revise your code. You miss ; after $query=..., and you have extra " in the last line.

answered Aug 29, 2012 at 20:14

Grzegorz

3,3753 gold badges27 silver badges45 bronze badges

Comments

Ray · Accepted Answer · 2012-08-29 20:14:27Z

1

You're missing a semicolon at the end of the line:

$query="INSERT INTO testtable (cli, env, type, fault)VALUES ('$CLI', '$Environment', '$Type', '$Fault')"

answered Aug 29, 2012 at 20:14

Ray

41.6k22 gold badges110 silver badges143 bronze badges

Comments

Stegrex · Accepted Answer · 2012-08-29 20:12:14Z

0

You'll need to connect to your DB using mysql_connect() first before running mysql_query().

http://php.net/manual/en/function.mysql-connect.php

answered Aug 29, 2012 at 20:12

Stegrex

4,0441 gold badge19 silver badges19 bronze badges

Comments

Mike Brant · Accepted Answer · 2012-08-29 20:14:03Z

0

You don't have a semicolon at the end of the $query="INSERT... line and you have an extra double quote before the semicolon on the last line.

The PHP errors that are issue should, point this out to you pretty clearly.

answered Aug 29, 2012 at 20:14

Mike Brant

71.4k10 gold badges102 silver badges104 bronze badges

Collectives™ on Stack Overflow

mysql_query Issue - Syntax error

5 Answers 5

3 Comments

Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

3 Comments

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related