PHP Wrong Parameters

Question

I'm trying to make a registration page but PHP is telling me that I have the wrong parameters, which doesn't make sense unless I need to add a parameter for the auto-incremental primary ID key.

Here's my SQL query call:

mysql_query("INSERT INTO Users (username, password, fname, lname, email) VALUES ('%s', '%s', '%s', '%s, '%s')",
        mysql_real_escape_string($username),
        mysql_real_escape_string($password),
        mysql_real_escape_string($first),
        mysql_real_escape_string($last),
        mysql_real_escape_string($email)) or die(mysql_error());

It gives me the wrong paramater count on the last line in this code block. Any ideas? I copied and pasted the row-names straight from my database.

my table is as follows:

id - int(11) - auto-incrementing
username - varchar(20)
password - varchar(20)
fname - varchar(35) 
lname - varchar(35)
email - varchar(254)

Next time, include the error message verbatim.

Lightness Races in Orbit
– Lightness Races in Orbit

2011-08-11 17:42:45 +00:00
Commented Aug 11, 2011 at 17:42 — Lightness Races in Orbit
– Lightness Races in Orbit, Commented Aug 11, 2011 at 17:42

Michael Berkowski · Accepted Answer · 2011-08-11 17:44:48Z

5

You have formatted the SQL query as a sprintf() call, but don't call sprintf()

mysql_query(sprintf("INSERT INTO Users (username, password, fname, lname, email) VALUES ('%s', '%s', '%s', '%s', '%s')",
            mysql_real_escape_string($username),
            mysql_real_escape_string($password),
            mysql_real_escape_string($first),
            mysql_real_escape_string($last),
            mysql_real_escape_string($email))) or die(mysql_error());
  // also note some parentheses out of place ^^^^^^^^^^^^^^^^^^^^^^^^

edited Aug 11, 2011 at 17:44

answered Aug 11, 2011 at 17:36

Michael Berkowski

271k47 gold badges450 silver badges395 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

Lightness Races in Orbit Over a year ago

There were no parentheses out of place. And he formatted the PHP function call that way, not the SQL query.

Howdy_McGee Over a year ago

:S this might be a whole other question, but I'm getting an "error near [email protected]" - does varchar accept the '@' symbol?

Michael Berkowski Over a year ago

@Tomalak As the intended sprintf() call there were. The mysql_query() was closed, the closing ) for sprintf() must be added, and I thought there was an extra closing ) after the die() originally but it was edited out.

Michael Berkowski Over a year ago

@Howdy_McGee There was another missing quote on the second to last %s. Edited in my answer

Lightness Races in Orbit Over a year ago

@Michael: There should be no closing ) for sprintf() if there is no sprintf() :)

|

Lightness Races in Orbit · Accepted Answer · 2011-08-11 17:49:39Z

2

It's PHP that's telling you off about parameters, not MySQL.

You've tried to use mysql_query like sprintf, which it is not. mysql_query accepts an optional database resource identifier, and the query string. Two parameters. That is all.

If you do want to use sprintf, then go for it:

mysql_query(
   sprintf(
      "INSERT INTO Users (username, password, fname, lname, email) VALUES ('%s', '%s', '%s', '%s, '%s')",
      mysql_real_escape_string($username),
      mysql_real_escape_string($password),
      mysql_real_escape_string($first),
      mysql_real_escape_string($last),
      mysql_real_escape_string($email)
   )
) or die(mysql_error());

But remember that the first argument to mysql_query is just a string. No magic.

edited Aug 11, 2011 at 17:49

answered Aug 11, 2011 at 17:40

Lightness Races in Orbit

387k77 gold badges670 silver badges1.1k bronze badges

1 Comment

Rolice Over a year ago

Correct, the query never reaches the MySQL in this case.

Lightness Races in Orbit · Accepted Answer · 2011-08-11 17:49:13Z

1

mysql_query(
    sprintf("INSERT INTO Users (username, password, fname, lname, email) VALUES ('%s', '%s', '%s', '%s, '%s')",
    mysql_real_escape_string($username),
    mysql_real_escape_string($password),
    mysql_real_escape_string($first),
    mysql_real_escape_string($last),
    mysql_real_escape_string($email)))

or die(mysql_error()); // sprintf to build a final string of your query by given format and "or die statement" is outside the mysql_query function call.

edited Aug 11, 2011 at 17:49

Lightness Races in Orbit

387k77 gold badges670 silver badges1.1k bronze badges

answered Aug 11, 2011 at 17:37

Rolice

3,1133 gold badges26 silver badges33 bronze badges

5 Comments

Rolice Over a year ago

Yes but it can work with one also. It is not needed to pass the connection.

Lightness Races in Orbit Over a year ago

@Mike: He's only passing it one.

Lightness Races in Orbit Over a year ago

@Rolice: Better indentation would have avoided Mike's confusion.

Mike Over a year ago

Oh darn, I missed the sprintf there :P

Rolice Over a year ago

Yes I use a new line and additional identation for the arguments, it seems readable to me, when lot of arguments are passed. It should looks good in editor. Also the or die is on new line to show its independence from the call of mysql_query. :D

Collectives™ on Stack Overflow

PHP Wrong Parameters

3 Answers 3

6 Comments

1 Comment

5 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

6 Comments

1 Comment

5 Comments

Your Answer

Sign up or log in

Post as a guest

Related