Wrong mysql query in php file?

Question

I'm trying to insert some data into my mysql database. The connection is working fine but im having a problem with sending the query correctly to the database. Below you can find the code in my php file. I also post what for type of fields they are in the Database.

Fields in the mysql database:
Reservaties_id = int
Materialen_id = int
aantal = int
effectief_gebruikt = tinyint
opmerking = Varchar2
datum_van = date
datum_tot = date


$resID = $_REQUEST['resID'];
    $materialen_id = $_REQUEST['materialen_id'];
    $aantal = $_REQUEST['aantal'];
    $effectief_gebruikt = $_REQUEST['effectief_gebruikt'];
    $opmerking = $_REQUEST['opmerking'];
    $datum_van = date('YYYY-MM-DD',$_REQUEST['datum_van']);
    $datum_tot = date('YYYY-MM-DD',$_REQUEST['datum_tot']);



            $string = "INSERT INTO `materialen_per_reservatie`(`reservaties_id`, `materialen_id`, `aantal`, `effectief_gebruikt`, `opmerking`, `datum_van`, `datum_tot`) VALUES ($resID, $materialen_id, $aantal, $effectief_gebruikt, '$opmerking', $datum_van, $datum_tot)";
            mysql_query($string);

Manigandan Arjunan · Accepted Answer · 2012-01-08 16:07:07Z

1

you have to include single quotes for the date fields '$dataum_van'

$string = "INSERT INTO `materialen_per_reservatie`(reservaties_id, materialen_id, aantal, effectief_gebruikt, opmerking, datum_van, datum_tot) VALUES ($resID, $materialen_id, $aantal, $effectief_gebruikt, '$opmerking', '$datum_van', '$datum_tot')";

and this is only a example query, while implementing don't forget to sanitize your inputs

answered Jan 8, 2012 at 16:07

Manigandan Arjunan

2,2651 gold badge25 silver badges43 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Community · Accepted Answer · 2017-05-23 10:24:22Z

Your code has some serious problems that you should fix. For one, it is not doing any error checking, so it's no surprise the query breaks silently when it fails. Check for errors and it will tell you what goes wrong - how to do it is outlined in the manual on mysql_query() or in this reference question.. Example:

$result = mysql_query($string);

// Bail out on error 
if (!$result)  
  { 
    trigger_error("Database error: ".mysql_error(), E_USER_ERROR); 
    die();
   }

In this specific case, I'm fairly sure it's because you are not putting your values into quotes after the VALUES keyword.

Also, the code you show is vulnerable to SQL injection. You need to escape every value you use like so:

$resID = mysql_real_escape_string($_REQUEST['resID']);

for this to work, you need to put every value in your query into quotes.

最白目 · Accepted Answer · 2012-01-08 16:11:23Z

0

try this

$string = "INSERT INTO `materialen_per_reservatie`(`reservaties_id`) VALUES ('".$resID."')";

edited Jan 8, 2012 at 16:11

answered Jan 8, 2012 at 16:05

最白目

3,6749 gold badges64 silver badges116 bronze badges

Collectives™ on Stack Overflow

Wrong mysql query in php file?

3 Answers 3

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related