syntax mysql/php error

Question

I really can't understand why this statement is wrong

$uname=$_POST['username'];
$pass=$_POST['pass'];
$str="select * from account where username='".$uname."' and password='".$pass."'";
echo $str;
echo "\n";
$str=mysql_real_escape_string($str);
$result=mysql_query($str) or die("Error: ". mysql_error(). " with query ". $str);
$num=mysql_num_rows($result);

It shows me:

select * from account where username='negin'and password='parsa' Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'negin\'and password=\'parsa\'' at line 1 with query select * from account where username=\'negin\'and password=\'parsa\'

ext/mysql is officially deprecated. Please use mysqli or PDO, and please also use prepared statements and placeholders. — pilcrow
– pilcrow, Commented Feb 22, 2012 at 16:29

Alfabravo · Accepted Answer · 2012-02-22 16:17:54Z

3

Use mysql_real_escape_string() on the parameters, no on the whole query. You are escaping the single quotes so the query goes wrong.

answered Feb 22, 2012 at 16:17

Alfabravo

7,5786 gold badges49 silver badges83 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Sam Arul Raj T · Accepted Answer · 2012-02-22 16:18:43Z

2

Use in this way

$uname=mysql_real_escape_string($_POST['username']);
$pass=mysql_real_escape_string($_POST['pass']);
$str="select * from account where username='".$uname."' and password='".$pass."'";

$result=mysql_query($str) or die("Error: ". mysql_error(). " with query ". $str);
$num=mysql_num_rows($result);

answered Feb 22, 2012 at 16:18

Sam Arul Raj T

1,77017 silver badges23 bronze badges

Comments

romo · Accepted Answer · 2012-02-22 16:19:13Z

0

I have problems running it like that as well, the issue is in the mysql_real_escape_string() section

//Change
$str="select * from account where username='".$uname."' and password='".$pass."'";

//To
$str="select * from account where username='".mysql_real_escape_string($uname)."' and password='".mysql_real_escape_string($pass)."'";

answered Feb 22, 2012 at 16:19

romo

1,99011 silver badges10 bronze badges

Comments

Shankar Narayana Damodaran · Accepted Answer · 2012-02-22 16:19:54Z

0

Since you are using the mysql_real_escape_string() on the whole $str. It also escapes the single quotes which you have manually added inorder to insert the variables,. thus leading to errors.

Try this way.

$uname=$_POST['username'];
$pass=$_POST['pass'];

$uname = mysql_real_escape_string($uname);
$pass = mysql_real_escape_string($pass);

$str="select * from account where username='".$uname."' and password='".$pass."'";
echo $str;
echo "\n";
//$str=mysql_real_escape_string($str);
$result=mysql_query($str) or die("Error: ". mysql_error(). " with query ". $str);
$num=mysql_num_rows($result);

answered Feb 22, 2012 at 16:19

Shankar Narayana Damodaran

68.6k43 gold badges102 silver badges129 bronze badges

Collectives™ on Stack Overflow

syntax mysql/php error

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related