Errors inserting values (such as URLs) into MySQL database WITH a URL

Question

I am working on my website and I can't access myPhpAdmin right now, so I tried making a script for inserting values for a search thing. However, when I visit the link, website.com/search/create.php?l=link&d=description&t=title, I get an error. This one

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'link, description, title)' at line 1

Here's what my script looks like.

$link = "https://website.com";
$description = "The homepage of the site";
$title = "Home";

// sql to create table
$sql = "INSERT INTO search (link, description, title) VALUES (".$link.", ".$description.", ".$title.")";

if (mysqli_query($conn, $sql)) {
echo "it's working";
} else {
echo "it's not working?" . mysqli_error($conn);
}

SQL Injection Little Bobby Tables xkcd.com/327 Open Web Application Security Project owasp.org/index.php/SQL_Injection (Answers suggesting single quotes be incorporated into the SQL text are incomplete if they don't also suggest properly escaping potentially unsafe values. Best practice is prepared statements with bind placeholders. — spencer7593
– spencer7593, Commented Mar 15, 2019 at 17:06

MoxGeek · Accepted Answer · 2019-03-15 17:02:15Z

1

replace

$sql = "INSERT INTO search (link, description, title) VALUES ('".$link."', '".$description."', '".$title."')";

instead of :

$sql = "INSERT INTO search (link, description, title) VALUES (".$link.", ".$description.", ".$title.")";

you are trying to insert a string without '

answered Mar 15, 2019 at 17:02

MoxGeek

4587 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Rakesh Jakhar · Accepted Answer · 2019-03-15 17:03:26Z

0

it seems you are missing single quotation in SQL query, try the following:-

$sql = "INSERT INTO search (link, description, title) VALUES ('".$link.", '".$description."', '".$title."')";

answered Mar 15, 2019 at 17:03

Rakesh Jakhar

6,4082 gold badges13 silver badges20 bronze badges

Comments

MoxGeek · Accepted Answer · 2019-03-15 17:06:40Z

0

Just Change the Query syntax in your code and check it ... Hope your error should be resolve.

// sql to create table
$sql = "INSERT INTO search (link, description, title) VALUES ('$link', '$description', '$title')";

edited Mar 15, 2019 at 17:06

MoxGeek

4587 silver badges18 bronze badges

answered Mar 15, 2019 at 17:02

Priyanka Maurya

3851 silver badge10 bronze badges

1 Comment

prasanth Over a year ago

its change inserted value.create extra dot in values like .text.

halfer · Accepted Answer · 2019-03-15 17:14:33Z

0

Your code for inserting data into database table is wrong (assuming you already executed database connection query ($conn) and have 'search' table on database).

$sql = "INSERT INTO search (link, description, title) VALUES ('$link', '$description', '$title')";

You don't have to put concatenate operator ('.') inside your SQL query as you are not concatenating PHP and markup texts.

edited Mar 15, 2019 at 17:14

halfer

20.2k20 gold badges110 silver badges207 bronze badges

answered Mar 15, 2019 at 17:11

Sreeraj Nair

597 bronze badges

Collectives™ on Stack Overflow

Errors inserting values (such as URLs) into MySQL database WITH a URL

4 Answers 4

Comments

Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related