PHP Search MySQL database Fatal error [duplicate] - php

This question already has answers here:
Syntax error due to using a reserved word as a table or column name in MySQL
(1 answer)
When to use single quotes, double quotes, and backticks in MySQL
(13 answers)
Closed 4 years ago.
I wrote the query system with android studio and PHP.
My PHP code is as follows.Opened with a web browser but an error occurred.The error message is as follows
Notice: Undefined index: searchQuery in C:\xampp\htdocs\client\beetle_search.php on line 5
Fatal error: Uncaught exception 'PDOException' with message
'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an
error in your SQL syntax; check the manual that corresponds to your
MariaDB server version for the right syntax to use near 'table 1 where
MATCH(name,scientific_name) AGAINST(NULL)' at line 1' in
C:\xampp\htdocs\client\beetle_search.php:9 Stack trace: #0
C:\xampp\htdocs\client\beetle_search.php(9): PDOStatement->execute()
1 {main} thrown in C:\xampp\htdocs\client\beetle_search.php on line 9
require_once('config.inc.php');
$search_query=$_POST['searchQuery'];
$sql = 'SELECT * from table 1 where MATCH(name,scientific_name) AGAINST(:search_query)';
$statement = $connection->prepare($sql);
$statement->bindParam(':search_query', $search_query, PDO::PARAM_STR);
$statement->execute();
if($statement->rowCount())
{
$row_all = $statement->fetchall(PDO::FETCH_ASSOC);
header('Content-type: application/json');
echo json_encode($row_all);
}
elseif(!$statement->rowCount())
{
echo "no rows";
}
Where did you write it wrong? thanks

You should add a table name in your query. Update your query
from
$sql = 'SELECT * from table 1 where MATCH(name,scientific_name) AGAINST(:search_query)';
to
$sql = 'SELECT * from table_name where MATCH(name,scientific_name) AGAINST(:search_query)';
Also, in order to use MATCH function, you must have the full text index on the column. Otherwise, you will get an error Can't find FULLTEXT index matching the column list'. The solution of this problem is given below...
Assuming you are using MyISAM engine, Execute:
ALTER TABLE table_name ADD FULLTEXT(name);
ALTER TABLE table_name ADD FULLTEXT(scientific_name);

Related

SQL throwing Syntax Error when using LIKE with Parameters [duplicate]

This question already has answers here:
How do I create a PDO parameterized query with a LIKE statement?
(9 answers)
Closed 6 years ago.
I am using PDO with PHP to submit queries to my SQL server. I need to use the LIKE clause to check a username to ensure that it is allowed (eg; it does not contain any banned words), so I am using this SQL query...
SELECT * FROM `table` WHERE (`name` LIKE %?%);
I am then inserting the paramater with PDO later like this...
$statement->bindParam(1, $username)
When I try to run this, I get this error...
Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '%'dibdibs'%)' at line 1' in C:\xampp\htdocs\scripts\sql.php:57 Stack trace: #0 C:\xampp\htdocs\scripts\sql.php(57): PDOStatement->execute() #1 C:\xampp\htdocs\api\users.php(30): dibdibs\pdo->query('SELECT * FROM `...', Array) #2 {main} thrown in C:\xampp\htdocs\scripts\sql.php on line 5
The PDO code works fine for other queries, when I am using = instead of LIKE, but is is throwing the above error when I try to use the LIKE clause.
I have put my full code on Pastebin, if you need to check it. I am using GET to get data, as I am using this with AJAX (which is also working fine), but the username I have tried is 'dibdibs', which works fine in other queries.
Use This
U can use any of these two
$query = $database->prepare('SELECT * FROM table WHERE column LIKE ?');
$query->execute(array('%value%'));
while ($results = $query->fetch())
{
echo $results['column'];
}
// without loop
$query = "SELECT * FROM tbl WHERE address LIKE ?";
$params = array("%$var1%");
$stmt = $handle->prepare($query);
$stmt->execute($params);

Dynamic table name setting with PDO [duplicate]

This question already has answers here:
Can PHP PDO Statements accept the table or column name as parameter?
(8 answers)
Closed 7 years ago.
So I am quite new to using PDO and although I have to it to work using static settings I would like to be able to change the table name in a statement.
I had a look at this question here. and saw the highly up voted answer. So I attempted to recreate a simple version which would just dump all the information within a column.
Question: Why is my edited version of that persons example not work and return this error below.
Fatal error: Uncaught exception 'PDOException' with message
'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an
error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near '' at line 1' in
C:\xampp\htdocs\ *****\database.php:84 Stack trace: #0
C:\xampp\htdocs\ *****\database.php(84): PDOStatement->execute() #1
C:\xampp\htdocs\ *****\database.php(88): buildQuery(1) #2 {main}
thrown in C:\xampp\htdocs\ *****\database.php on line 84
The code from the example linked with my small alterations.
function buildQuery( $get_var )
{
switch($get_var)
{
case 1:
$tbl = `r16.7`;
break;
}
global $db;
$sql = "SELECT * FROM $tbl";
$stmt = $db->prepare($sql);
$stmt->execute();
$result = $sth->fetchAll(PDO::FETCH_COLUMN, 1);
var_dump($result);
}
buildQuery(1);
Do not confuse PHP and SQL.
You just used SQL quotes in PHP. While you have to use SQL quotes in SQL.
Linked answer is now fixed, so, I am closing this as a duplicate.

PDO Fatal Error Check Syntax [duplicate]

This question already has an answer here:
Syntax error due to using a reserved word as a table or column name in MySQL
(1 answer)
Closed 7 years ago.
For some reason I'm gettin this error on the second line of included code:
Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'div='CA' WHERE vid='400373'' at line 1' in /home/stretch045/public_html/scripts/auth.php:12 Stack trace: #0 /home/stretch045/public_html/scripts/auth.php(12): PDO->prepare('UPDATE users SE...') #1 /home/stretch045/public_html/index.php(35): Auth->checkToken('94257b73ea4ed51...') #2 {main} thrown in /home/stretch045/public_html/scripts/auth.php on line 12
code
$conn = $this->db;
$stmt = $conn->prepare("UPDATE users SET rating='".$xml->rating."', atc='".$xml->ratingatc."', pilot='".$xml->ratingpilot."', div='".$xml->division."' WHERE vid='".$xml->vid."'");
$stmt->execute();
if($stmt->rowCount()==0){
$stmt = $conn->prepare("INSERT INTO users (vid, fname, lname, rating, atc, pilot, div) VALUES (".$xml->vid.",".$xml->firstname.",".$xml->lastname.",".$xml->rating.",".$xml->ratingatc.",".$xml->ratingpilot.",".$xml->division.")");
$stmt->exec($stmt);
echo 'data inserted into db';
}
div is a reserved keyword in MySQL and needs to be escaped by backticks.
INSERT INTO users (vid, ..., `div`) VALUES (...)

MySQL erroring out on one field in PHP [duplicate]

This question already has answers here:
Select a column with a keyword name
(6 answers)
Closed 8 years ago.
I have this pre-existing table structure (yes data and time are terrible names but they are already there):
However everything grinds to a halt on updating the in/out field.
(Also tried with prepared statements: no luck)
This does not work:
$update_punch = $conn->query("UPDATE ttime SET date='$the_edited_date_w_mysql', time='$the_edited_time', inout='$the_ins_and_outs' WHERE id='$the_id' LIMIT 1");
The first line of this works but it chokes on the 2nd (chocks with inout being a var or 'in':
$update_punch = $conn->query("UPDATE ttime SET date='$the_edited_date_w_mysql', time='$the_edited_time' WHERE id='$the_id' LIMIT 1");
$update_punch = $conn->query("UPDATE ttime SET inout='$the_ins_and_outs' WHERE id='$the_id' LIMIT 1");
Here is there error:
Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'inout='out' WHERE id='171366' LIMIT 1' at line 1' in /site/updatepunchesbystore2.php:43 Stack trace: #0 /site/updatepunchesbystore2.php(43): PDO->query('UPDATE ttime SE...') #1 {main} thrown in /site/updatepunchesbystore2.php on line 43
I have fought with it for an hour and I'm stumped!
Any thoughts?
wrap the keywords in backticks
`inout`='$the_edited_time'
should work for you
Try this:
$qry= "UPDATE ttime SET `inout`='{$the_ins_and_outs}' WHERE id='$the_id'";
$update_punch = $conn->query($qry);

PDO Find a needle in a haystack SQL statement

I am using PDO, and am thrown an error when using the following code:
$stmt = $pdo->prepare("SELECT username FROM users WHERE
WHERE INSTR(`games`, '{$gameid}') > 0
");
$gameid = $gamedata['id'];
$stmt->execute(array(
':gameid'=>$gameid
));
$players = $stmt->fetch(PDO::FETCH_ASSOC);
Through looking at past answers this is supposed to work, however I am met with the following error:
Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: Syntax
error or access violation: 1064 You have an error in your SQL syntax; check the manual
that corresponds to your MySQL server version for the right syntax to use near 'WHERE
INSTR(`games`, 'crysis') > 0' at line 2' in C:\xampp\htdocs\gs\gamepage.php:19 Stack
trace: #0 C:\xampp\htdocs\gs\gamepage.php(19): PDOStatement->execute(Array) #1 {main}
thrown in C:\xampp\htdocs\gs\gamepage.php on line 19
It also appears it's grabbing 'games' as a literal and not the column
What am I doing wrong?
You have a double WHERE:
SELECT username FROM users WHERE
WHERE
You're also doing some funny things with $gameid, namely setting the variable after substitution, and binding an unused :gameid parameter. You also have a SQL injection vulnerability and should really use a parameter to pass $gameid instead of creating dynamic SQL.
You have the word games encased in "back quotes" and not "single quotes" like the {$gameid} variable is using. They are probably making the db engine assume it is a column name instead of text.
$stmt = $pdo->prepare('SELECT `username` FROM `users`
WHERE INSTR(`games`, :gameid) > 0;');
And you should use $stmt->bindValue() or $stmt->bindParameter() before executing the query.
This won't work if gameid is an ... INTEGER ! ? ! ?

Categories