getting error in my php/sql script?

Question

While trying to create a website on which users can buy and sell stocks, I encountered the following error while trying to implement the "sell" option. Users can type in the symbol of some stock they have, and then the website ought to delete all stocks with that symbol (by means of a POST method). I use the following sql statements in sell.php (the controller):

query("DELETE FROM userstocks WHERE id = ".$_SESSION["id"]." 
                                     AND symbol = ". $_POST["symbol"] ) ;  
query("UPDATE users SET cash = cash + 200 WHERE id = " . $_SESSION["id"]) ;   
render("sellconfirmation.php", ["cash" => $cash]);

There is sometheing wrong with the DELETE FROM query, though. I get the following error:

Fatal error: Unknown column 'fb' in 'where clause' in /home/jharvard/vhosts/pset7/includes/functions.php on line 139

I think this is strange, because when I manually type in the actual 'fb' stock (as in: AND symbol = 'symbol' ) it all works perfectly well. I want the website to delete the stock based on what the user typed in though.

Question: What's wrong with the DELETE FROM query?

What happens if I POST the following "symbol"? lolhax' or '1 — Niet the Dark Absol
– Niet the Dark Absol, Commented Feb 6, 2014 at 12:10
before anyone else spams you with it: stackoverflow.com/questions/60174/… — Marriott81
– Marriott81, Commented Feb 6, 2014 at 12:28

Mario · Accepted Answer · 2014-02-06 12:23:44Z

2

Add quote to symbol

query("DELETE FROM userstocks WHERE id = " . $_SESSION["id"] . " 
                   AND symbol = '". $_POST["symbol"]."'" ) ;

EDIT:

Also use mysqli_real_escape_string or PDO::quote to secure your string.

edited Feb 6, 2014 at 12:23

answered Feb 6, 2014 at 12:09

Mario

1,7161 gold badge23 silver badges30 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Niet the Dark Absol Over a year ago

And fix the injection hole.

Max Lonysa Muller Over a year ago

Thanks! (... more characters)

The Hungry Dictator · Accepted Answer · 2014-02-06 12:14:07Z

2

You missed out to close the quote in the delete query. Try this

query("DELETE FROM userstocks WHERE id = " . $_SESSION["id"] . " 
                          AND symbol = '". $_POST["symbol"]."'" ) ;

edited Feb 6, 2014 at 12:14

The Hungry Dictator

3,4845 gold badges41 silver badges56 bronze badges

answered Feb 6, 2014 at 12:11

Jenz

8,3718 gold badges50 silver badges83 bronze badges

1 Comment

Max Lonysa Muller Over a year ago

Thank you! (more characters)

Collectives™ on Stack Overflow

getting error in my php/sql script?

2 Answers 2

2 Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related