mysql real escape string error

Question

Code:

mysql_query("INSERT INTO Account(User,
Pw, email)
VALUES('mysql_real_escape_string($_POST[user])',
'$pw','mysql_real_escape_string($_POST[email])
) ")  or die(mysql_error());

Error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''mysql_real_escape_string(123) )' at line 1

Please help

John Coates · Accepted Answer · 2010-12-26 22:44:17Z

3

The problem is that you're quoting a PHP command, so it never gets passed to PHP

try this

mysql_query("INSERT INTO Account(User, Pw, email) VALUES('".mysql_real_escape_string($_POST[user])."', '$pw','".mysql_real_escape_string($_POST[email])."' ) ") or die(mysql_error());

but your $_POST[user] calls might also fail if user isn't a defined constant, so maybe try this

mysql_query("INSERT INTO Account(User, Pw, email) VALUES('".mysql_real_escape_string($_POST['user'])."', '$pw','".mysql_real_escape_string($_POST['email'])."' ) ") or die(mysql_error());

answered Dec 26, 2010 at 22:44

John Coates

4761 gold badge6 silver badges14 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

TehShrike Over a year ago

To put it another way - this is the query that is getting passed to MySQL:

INSERT INTO Account(User, Pw, email) VALUES('mysql_real_escape_string($_POST[user])', '$pw','mysql_real_escape_string($_POST[email]) )

... and that is not a valid MySQL query (it contains PHP functions). This answer fixes the issue. I'm curious, though, should $pw be escaped as well?

Your Common Sense · Accepted Answer · 2010-12-26 23:52:55Z

0

Do not stuff all your code into one line.
You don't have to pay for each additional operator. Write distinctly.

$user  = mysql_real_escape_string($_POST['user']);
$email = mysql_real_escape_string($_POST['email']);
$pw    = mysql_real_escape_string($pw);

$query = "INSERT INTO Account(User,Pw, email) VALUES ('$user','$pw','$email')";
mysql_query($query) or trigger_error(mysql_error().$query);

answered Dec 26, 2010 at 23:52

Your Common Sense

158k42 gold badges226 silver badges373 bronze badges

Collectives™ on Stack Overflow

mysql real escape string error

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related