hello i have a question about some SQL query that keep give me an error
Code :
$result = mysql_query("SELECT email FROM users WHERE user_id='$uid' and set emailchange=1");
the query keep giving me an error
any help ?
Try following query
$result = mysql_query("SELECT email FROM users WHERE user_id=$uid and emailchange=1");
You can also update after select the data:
$result = mysql_query("SELECT email FROM users WHERE user_id='$uid' and set emailchange=1");
if($result){
$result2 = mysql_query("UPDATE email set emailchange=1 WHERE user_id='$uid'");
}
The error is caused by the set here:
and set emailchange=1
You can't select and update in the same SQL statement, you need to execute the update statement then write a select statement to grab the email - assuming that is what you mean to do so:
Update the field:
$result = mysql_query("UPDATE users set emailchange = 1 where user_id='$uid'");
select the data:
$result2 = mysql_query("select email from users where user_id='$uid'");
You really should escape $uid before passing it to the query and ideally you should be using PDO!
Related
I have a Mysql Database named user. Here is a picture:
I want to change the Username of the user "dodlo.rg" programmatically.
Actually, I have the PHP-Version 7.1. And this is a part of my PHPCode:
EDITED CODE:
$newName= $_POST["changeT"];
$userId = $_POST["userId"];
$db = mysqli_connect("trolö", "trolö", "trolö123", "trolö")
$sql = "UPDATE user SET username = '$newName' WHERE user_id = '$userId'";
$query = mysqli_query($db, $sql);
$response["successU"] = true;
But I get the Error: "You gave an Error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'SELECT * FROM user' at line 1"
Thanks in advance.
The problem lies in 2 parts.
Firstly, since this column is a varchar field it needs to be inside quotes else it produces an sql error.
Secondly the SELECT statement just after is not valid, but i guess it was a copy/paste error.
Therefore your working code should be:
$newName= $_POST["changeT"];
$db = mysqli_connect("trolö", "trolö", "trolö123", "trolö")
$sql = "UPDATE user SET username = '".addslashes($newName)."' WHERE username = 'dodlo.rg'";
$query = mysqli_query($db, $sql);
$response["successU"] = true;
Also, please consider using your primary keys on your where statement rather a varchar field, as it'll improve speed when more complex queries. (eg. where user_id = 35 instead of where username = 'dodlo.rg' ).
Lastly, but quite important this code might be vulnerable to sql injections. You need to use prepared statements.
You have to convert this query into two parts
$sql1 = "UPDATE user SET username = $newName WHERE username = 'dodlo.rg'";
$sql2 = "SELECT * FROM user";
I have php script like this
$query = "select * where userid = 'agusza' ";
$result = mysql_query($query) or die(mysql_error());
while($row=mysql_fetch_array($result)) {
echo $result;
}
when I execute, the result like this
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'where userid = 'agusza'' at line 1
But when I run that sql in sqlserver, it running well
Anybody has solution ?
$query = "select * from table_name where userid = 'agusza' ";
See the corrections I have made. You haven't used the right syntax for SELECT query
You didn't select a table using FROM. Without that, it does not know which table you are selecting data from.
You should also stop using mysql as it is deprecated. Use mysqli or PDO as they are safer.
You are also echoing the wrong variable in your while loop, try this:
while ($row = mysql_fetch_array($result) {
echo $row['column_name'];
}
$query = "select * from table where userid = 'agusza'";
Right now, you're not telling which table SQL should look in.
You should format your query like so:
select * from `TableName` where userid='agusza'
In your query below you doesnt state the database table where you should get that data using FROM
$query = "select * where userid = 'agusza' "; // instead of this
$query = "select * FROM declaredtable where userid = 'agusza' "; used this
I have a query on my page that uses a GET variable to pull data from my table...
If I echo my GET var the data is there so im doing something wrong with my query, instead of or die can I show an error in the browser?
// Get USER ID of person
$userID = $_GET['userID'];
// Get persons
$sql = 'SELECT * FROM persons WHERE id = $userID';
$q = $conn->query($sql) or die('failed!');
$sql = "SELECT * FROM persons WHERE id = $userID";
You must use double quotes to use variables inside the query string.
You can also do this:
$sql = "SELECT * FROM persons WHERE id = ".$userID;
What you should do is this (to protect yourself from sql injection):
$safeuid = $conn->prepare($userID);
$sql = "SELECT * FROM persons WHERE id = ".$safeuid;
You can always debug using this at the top of your php page:
ini_set('display_errors',1);
error_reporting(E_ALL);
Have you tried $q = $conn->query($sql) or die($conn->error()); ?
Yes you can, but you should only do it for debugging. Crackers can gain a lot of insight by purposefully feeding bad input and reading the error.
I'm assuming you're using MySQLi; the command is $conn->error(). So your line would be:
$q = $conn->query($sql) or die($conn->error());
Also, what you're doing wrong is you're using single quotes to define $sql. You need to use double quotes to write $userID into the string. So what you want is:
$sql = "SELECT * FROM persons WHERE id = $userID";
or
$sql = 'SELECT * FROM persons WHERE id = ' . $userID;
You need to use double quotes to evaluate variables within the string. That is,
$sql = 'SELECT * FROM persons WHERE id = $userID';
should be
$sql = "SELECT * FROM persons WHERE id = $userID";
Rather than removing the die you should make sure the query is always valid. In other words: validate the userID parameter. $_GET can contain anything the user wants to provide - it could be an array, it could be a string, it could be a string with a malicious payload that can drop your tables. So check it is an integer. If not, return a relevant message to the user.
Not a php expert but you might try:
// Get USER ID of person
$userID = $_GET['userID'];
// Get persons
$sql = 'SELECT * FROM persons WHERE id = $userID';
$q = $conn->query($sql) or die('failed!' . mysql_error());
The error should append to the end of your die message.
I've created a login page and in the db table i have a field called last_access to store last login date and time the data type is timestamp
The following is the select statement;
$sql="SELECT * FROM $tbl_name WHERE $db_usercol='$myusername' and $db_passcol='$mypassword'";
$result=mysql_query($sql);
How can i update the field "last_access" every time the user logs in? and set the value to NOW().
Thanks
UPDATE $tbl_name set last_access = NOW() WHERE $db_usercol='$myusername'
or you could use
UPDATE $tbl_name set last_access = NOW() WHERE
$db_usercol='$myusername' AND $db_passcol='$mypassword'
instead of your select, and check how many rows were affected. If none ->login unsuccessfull. if 1 -> login successfull. If more, you got a problem...
But first thing should be removing that SQL injection vulnerability!
Check http://php.net/manual/en/book.pdo.php , some changes would be needed in your SQL functions but it is actually pretty easy to use, example:
$pdo = new PDO("mysql:host=localhost;dbname=yourdbname", 'dbuser', 'dbpass');
$stmt = $pdo->prepare('SELECT * from table where column = :column');
$stmt->bindParam(':column', $column);
$stmt->execute();
$result = $stmt->fetchAll();
It is easy and SQL injection attacks will be unsuccesfull
Add this in the login script/function:
$sql = sprintf("UPDATE %s SET last_access = NOW() WHERE id = %d", $tbl_name, $user_id);
$result = mysql_query($sql);
Hope that helps.
After successful authentication, you could do:
//get the id after user has logged in then run the update query
mysql_query("UPDATE your_table SET `last_access` = NOW() WHERE id =".$id);
I need help finishing this statement. It is frustrating that two of the PHP phone books here gloss over PDO's almost all together.
All I need to do is check the database for a username that is already taken.
Here is the start of the statement.
$sql = " SELECT * FROM users WHERE userid = '$userid'";
$result = $dbh->query($sql);
What parts do I need to add to write my 'if' statement?
Something like this:
$sql = " SELECT * FROM users WHERE userid = '$userid'";
$result = $dbh->query($sql);
$row = $result->fetch();
if ($row)
echo 'Userid is taken';
I'm not sure about your question because you're asking about username but selecting userid... did you mean to select on username?