hi im using mysqli and i saw some examples using placeholder like :something and ?
when i used ? its working, but when i used :something in query like this
$sql = INSERT INTO food(food_name)
VALUES(:food_name)
then error showed up when i called
$mysqli_object->prepare($sql);
error message sounds like this
User Error! You have an error in your
SQL syntax; check the manual that
corresponds to your MySQL server
version for the right syntax to use
near ':food_name)' at line
but when i used ? as the placeholder, everything working well, i used PHP 5.3.1 and MySQL 5.1.41
am i missed somewhere, any help will be appreciated thanks
mysqli does not support named placeholders.
PDO does, using either bindParam or execute.
(Careful, you can only use a named placeholder once per query. They aren't too incredibly useful.)
Related
I'm having a problem when trying to add a URL to a mySQL database.
The string is a URL:
http://pbs.twimg.com/profile_images/1708867059/405000_10150426314376065_707061064_8645107_703731598_n_normal.jpg
The error I get is:
Error description: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '://pbs.twimg.com/profile_images/1708867059/405000_10150426314376065_707061064_86' at line 1
It seems as though it won't allow me to add a URL, I presume there is something wrong with some of the characters but I don't know what?
My SQL is:
INSERT INTO accounts (name,consumerkey,consumersecret,pic_url) VALUES ($twitterID,$consumerkey,$consumersecret,$picture_url)"
You cannot truly solve this kind of problem by adding a few characters (like ' or ") to your bespoke sql string!
Instead, get to know the real way to write sql in php (it's like a very badly kept secret), which is to use PDO statements. This will allow you to use placehoders like (:twitterID, :consumerKey, :consumerSecret, :pictureUrl) which will accept complex variables such as urls and any of the crap users send in much more gracefully.
In the long run, this will save you a lot of trouble and time.
You need to quote string values and any other character that SQL will complain about, in this case it's the colon; see further down below.
($twitterID,$consumerkey,$consumersecret,'$picture_url')
or
('".$twitterID."','".$consumerkey."','".$consumersecret."','".$picture_url."')
if you wish to quote all the values.
Sidenote: You can remove the quotes around the variables that are integers.
I.e.:
This based on, and without seeing how the rest of your code looks like:
$picture_url = "http://pbs.twimg.com/profile_images/1708867059/405000_10150426314376065_707061064_8645107_703731598_n_normal.jpg";
The error states that it is near : - near being just that, the colon.
...right syntax to use near '://pbs.twimg.com
^ right there
You can also use:
VALUES ($twitterID, $consumerkey, $consumersecret, '" .$dbcon->real_escape_string($picture_url) . "')";
$dbcon is an example of a DB connection variable and based on mysqli_ syntax.
Something you haven't stated as to which MySQL API you are using.
Plus, your present code is open to SQL injection.
Use prepared statements, or PDO with prepared statements.
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ','','','')' at line 2
i get the above error when running my php file.
my insert query is
$updateUserCanvas="insert into user_canvas(cns_id,course_id,context_id,email_id,resource_id) values(".$canvasId.",".$courseId.",'".$contextId."','".$email."','".$resourseid."')";
cns_id,course_id are integer datatype and context_id,email is varchar and resource_id is text datatype
I searched for the problem and tried adding mysql_real_escape_string
$updateUserCanvas="insert into user_canvas(cns_id,course_id,context_id,email_id,resource_id) values(".$canvasId.",".$courseId.",'".mysql_real_escape_string($contextId)."','".mysql_real_escape_string($email)."','".mysql_real_escape_string($resourseid)."')";
But still not working. i dont know where am mistaking.any help is greatly appreciated.Thanks.
Try This
$updateUserCanvas="insert into user_canvas(cns_id,course_id,context_id,email_id,resource_id) values('".$canvasId."','".$courseId."','".addslashes($contextId)."','".addslashes($email)."','".addslashes($resourseid)."')";
It's something wrong with your $courseId, it may be some string instead of int. Try this string:
$updateUserCanvas="insert into user_canvas (cns_id,course_id,context_id,email_id,resource_id) values ('{$canvasId}','{$courseId}','{$contextId}','{$email}','{$resourseid}')";
I have the following mysql query:
REPLACE INTO application (export_date,application_id,title,recommended_age,artist_name,seller_name,company_url,support_url) VALUES (1362564068339,564783832,Eyelashes,4+,Char Room,Char Room,http://,http://ios.charroom.net/,http://itunes.apple.com/app/)
I get the following error:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Char Room,Char Room,http://,http://ios.charroom.net/,http://itunes.apple.com/app' at line 1
I cant seem to see where the error is. Can someone help me out?
You must know that the above is an echo of the actual query. All the parameters in this query went through mysql_real_escape_string before being to the query.
Well, firstly you shouldn't be using mysql_real_escape_string:
This extension is deprecated as of PHP 5.5.0, and will be removed in the future. Instead, the MySQLi or PDO_MySQL extension should be used.
Secondly, you still need to put the quotes around the strings. mysql_real_escape_string will escape quotes within the string, but it doesn't add the quotes to the start and end.
You have to put quotes around data you are inserting in your database.
When using the below command
$query=$comm->prepare("DELETE FROM ? WHERE id = ?");
I am receiving the following error
You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use
near '? WHERE id = ?' at line 1
if i remove ? and replace it with table name the code is working properly. Please Help
? is used for parameters, which can change. Why are you using ? for the table name? It remains constant.
Table names cannot be parametrized. Since you supply the table name, and not the user (right?), it should be safe to concatenate/interpolate normally.
Here is the mysql insert the I am running in php. I have removed the part giving the error but then I get a error on the next piece. I am not seeing what is diffrent to cause the error.
$fields="adv_exchange SET synum='".$synum."', worknum='".$_POST['worknum']."', user_id='".$current_user->ID."', f_name='".$current_user->user_firstname."', l_name='".$current_user->user_lastname."', email='".$current_user->user_email."', regnum=".$_POST['regnum'].", item='".$item."', qsver='".$_POST['qsver']."', flashrom='".$_POST['flashrom']."',expansion='".$_POST['board']."', rdisplay='". $_POST['rdisplay']."', screen_model='".$_POST['screen_model']."', p_hardware='".$_POST['cable']."', pcolor='".$_POST['pcolor']."', pname='".$_POST['pname']."', kboard='".$_POST['kboard']."', ip='".$_POST['ip']."', reg_name='".$_POST['reg_name']."', mem=".$_POST['mem'].", dt_server='".$_POST['dt_server']."', alert='".$_POST['alert']."', ows='".$_POST['ows']."', w_date='".$_POST['w_date']."', flashromver='".$_POST['flashromver']."', s_size='".$_POST['s_size']."', mag='".$_POST['mag']."', rcard='".$_POST['rcard']."', kvsid=".$_POST['kvsid'].", finger='".$_POST['finger']."', stand_alone='".$_POST['stand_alone']."', standards='".$_POST['standards']."', profile='".$_POST['profile']."', man_date='".$_POST['man_date']."', l_sn='".$_POST['l_sn']."', misc='".$_POST['misc']."', problem='".$_POST['problem']."'";
then $query = "insert into $fields";
I receive back
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ' item='JS900CV', qsver='', flashrom='',expansion='', rdisplay='', screen_model='' at line 1
Blockquote
if I echo the $query I get this:
insert into adv_exchange SET synum='SY5135', worknum='123456', user_id='2', f_name='REMOVED', l_name='REMOVED', email='REMOVED', regnum=, item='JS900CV', qsver='', flashrom='',expansion='', rdisplay='', screen_model='', p_hardware='', pcolor='', pname='', kboard='', ip='192.168.1.16', reg_name='', mem=, dt_server='', alert='', ows='', w_date='', flashromver='', s_size='', mag='', rcard='', kvsid=3, finger='', stand_alone='', standards='', profile='', man_date='', l_sn='', misc='misc test\r\n', problem='gen test'
Depending on what I enter in the error is changing spots in my statement. Not all fields are used the form is dynamic that is supplying the data so the fields are dependent on what options are selected. On a side note in case of concern about using $_POST to insert directly into mysql, I sanitize the array first. Any help would be greatly appreciated.
Look at regnum=,. You don't provide a value for regnum. Either leave it out entirely or set it to an appropriate value.
You're using a very, very bad approach to MySQL databases: manually creating the queries. You should really use prepared statements instead: this issue will be resolved as well.
Don't use mysql_* functions, use PDO instead.
Your code would look like this (simplified):
// This holds the query
$statement = $pdo->prepare('INSERT INTO adv_exchange SET synum=?, worknum=?, etc=?, problem=?');
// This executes it with the given arguments. It's 100% injection-proof and safe. In fact, it's also faster.
$statement->execute(array($synum, $_POST['worknum'], $_POST['therest'], $_POST['problem']));
regnum=".$_POST['regnum']." is causing the problem. When it is undefined, you get regnum=, in the SQL query
A bigger concern is that you are not escaping your inputs. Either use mysql_real_escape_string around them, or better, use prepared statements.
You need to SET regnum=SOMETHING.
Currently it's empty.