Getting "You have an error in your SQL syntax" error when submit php form

Question

I'm creating a very simple php forum system to integrate with my portal system (I tried to integrate some existent ones, but all I've found have lots of features I don't want, so I decided to create my own). The page bellow is just a start point from the board creation page, but when I click on submit, I just get the following error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'desc='Testing special characters á é ó ç ã ñ'' at line 1

<?php
 function renderForm($nome, $desc, $error)
 {

     $nome = htmlspecialchars($_POST['nome']);
 $desc = htmlspecialchars($_POST['desc']);

 ?>
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
 <html>
 <head>
 <title>New Record</title>
 </head>
 <body>
 <?php 
 if ($error != '')
 {
 echo '<div style="padding:4px; border:1px solid red; color:red;">'.$error.'</div>';
 }
 ?> 

 <form action="" method="post">
 <div>
 <strong>Nome: *</strong> <input type="text" name="nome"  /><br/>
 <strong>Desc: *</strong> <input type="text" name="desc" /><br/>
 <p>* required</p>
 <input type="submit" name="submit" value="Submit">
 </div>
 </form> 
 </body>
 </html>
 <?php 
 }
include("../../config.php");

 if (isset($_POST['submit']))
 { 
 $nome = htmlspecialchars($_POST['nome']);
 $desc = htmlspecialchars($_POST['desc']);
 if ($nome == '' || $desc== '')
 {
 $error = 'ERROR: Please fill in all required fields!';

 renderForm($nome, $desc, $error);
 }
 else
 {

 mysql_query("INSERT forum_boards SET nome='$nome', desc='$desc'")
 or die(mysql_error()); 
 }

 }
 else
 {
 renderForm('','','');
 }
?>

What could be this?

"check the manual that corresponds to your MySQL server version". I wonder if doing that would help... Be aware that you are using an obsolete database API and should use a modern replacement. — user1233508
– user1233508, Commented Jul 4, 2013 at 15:54
desc is a MySQL reserved word; you need to wrap it in backticks in your SQL if you're using it as a column name — Mark Baker
– Mark Baker, Commented Jul 4, 2013 at 15:55
oh that nasty desc word - a curse of all the php noobs (and endless source of the rep points for the SO haunters) — Your Common Sense
– Your Common Sense, Commented Jul 4, 2013 at 15:56
Thanks all of you (except Your Common Sense). I changed the "desc" column. — Jimmy
– Jimmy, Commented Jul 4, 2013 at 16:17

beiller · Accepted Answer · 2013-07-04 15:55:56Z

2

Improper insert syntax. The proper form is:

INSERT INTO forum_boards (`nome`, `desc`) VALUES ('$nome', '$desc')

Also you need to escape your inputs to prevent SQL injection:

$nome = mysql_real_escape_string(htmlspecialchars($_POST['nome']));
$desc = mysql_real_escape_string(htmlspecialchars($_POST['desc']));

ALSO someone will complain that mysql_* functions are depreciated. I feel like a compiler!

answered Jul 4, 2013 at 15:55

beiller

3,1351 gold badge14 silver badges20 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

Your Common Sense Over a year ago

Who on the earth upvoting it?

Bojangles Over a year ago

It sort of deserves one now that there are backticks in there

beiller Over a year ago

Hello common sense. Your comment adds nothing to this discussion and yet its been upvoted... ;)

Jimmy Over a year ago

Thank you, @beiller. It solved the sql problem (and thank you about the sql injection tip).

Nedret Recep Over a year ago

What's wrong with the syntax INSERT INTO table SET filed = value. Is much easier to read and modify. And why would you do htmlspecialchars before inserting data. The database should store the real data, not encoded data. Then while showing that data in some environment, example HTML you would escape them.

|

gries · Accepted Answer · 2013-07-04 15:57:05Z

0

Insert works like this:

INSERT forum_boards (colum_name1,column_name2,column_name3) VALUES($value1, $value2, $value3); etc.

Also take care your code is vulnerable to SQL-Injection http://en.wikipedia.org/wiki/SQL_injection

Also take care the mysql_* functions are officially deprecated!

answered Jul 4, 2013 at 15:57

gries

1,1426 silver badges30 bronze badges

2 Comments

gries Over a year ago

please add a reason for the downvote so i can improve my next answer :)

andrewsi Over a year ago

I suspect it's because you're not quoting either the column names or the values, which will mean that this won't actually fix this issue (desc needs to be quoted, as it's a reserved word); and will also break if there are strings being added.

Dr_Dang · Accepted Answer · 2013-07-04 16:04:20Z

0

Try to use single quotes in place of double quotes.
Execution speed of single quotes is more than double quotes.

Try to save query in variable, it is more readable

$query='INSERT INTO forum_boards (nome,desc) VALUES("'.$nome.'","'.$desc.'")';

//try to use mysqli,It is much advanced and always use prepared statement

mysqli_query($query);

answered Jul 4, 2013 at 16:04

Dr_Dang

4526 silver badges15 bronze badges

1 Comment

Dr_Dang Over a year ago

commom sense is uncommom in common people..!! huh

Collectives™ on Stack Overflow

Getting "You have an error in your SQL syntax" error when submit php form

3 Answers 3

6 Comments

2 Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

6 Comments

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related