Solved

MySQL Error

Posted on 2013-06-18
7
379 Views
Last Modified: 2013-06-19
I'm having a problem finding the error in this code.  This is the error.

Database error: Invalid SQL: SELECT * FROM customer_order where orderId= Database error: Invalid SQL: INSERT INTO customer_order (RestId,streetnumber,streetname,cross,apt,city,state,zip,latestProcessStatus,summary,OrderDate,DeliveryTime,PayStatus, comments,OrderPolicyId,lastname,firstname,phone) VALUES (2,\"Street Number\",\"Street Name\",\"Cross Street\",\"Apt Number\",\"City\",\"State\",\"Zip Code\",\"pending\", \"no summery\", NOW(),\"8:00PM\",\"1\",\"\",\"1\",\"Last Name\",\"First Name\",\"212.222.2222\")
nMySQL Error: 1064 (You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near \'cross,apt,city,state,zip,latestProcessStatus,summary,OrderDate,DeliveryTime,PayS\' at line 1)
nSession halted.
nMySQL Error: 1064 (You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Database error: Invalid SQL: INSERT INTO customer_order' at line 1)
nSession halted.






$item1=$_POST['item1'];
$streetnumber=$_POST['streetnumber'];
$streetname=$_POST['streetname'];
$cross=$_POST['cross'];
$apt=$_POST['apt'];
$city=$_POST['city'];
$state=$_POST['state'];
$zip=$_POST['zip'];
$deliverytime=$_POST['deliverytime'];
$paystatus = ($_POST['paymethod'] == '')?'1':'2';
$comments = $_POST['comments'];
$OrderPolicyId = $_POST['ordertype'];
$lastname = $_POST['lastname'];
$firstname = $_POST['firstname'];
$phone = $_POST['phone'];
include ('includes/database.php');
$db = new Database;

$sql_insert_order='INSERT INTO customer_order (RestId,streetnumber,streetname,cross,apt,city,state,zip,latestProcessStatus,summary,OrderDate,DeliveryTime,PayStatus, comments,OrderPolicyId,lastname,firstname,phone)
VALUES (2,"'.$streetnumber.'","'.$streetname.'","'.$cross.'","'.$apt.'","'.$city.'","'.$state.'","'.$zip.'","pending", "no summery", NOW(),"'.$deliverytime.'","'.$paystatus.'","'.$comments.'","'.$OrderPolicyId.'","'.$lastname.'","'.$firstname.'","'.$phone.'")';

Open in new window

0
Comment
Question by:DS928
7 Comments
 
LVL 83

Expert Comment

by:Dave Baldwin
ID: 39258056
That's confusing.  Your text and the code you posted are about two different things.  How do you get a SELECT and an INSERT into the same error message?
0
 

Author Comment

by:DS928
ID: 39258069
Sure is Dave.  Found the problem.  Had an extra field in there.  "Pay Status"
0
 
LVL 108

Accepted Solution

by:
Ray Paseur earned 500 total points
ID: 39258132
Just for future reference, a statement like this does nothing but propagate a variable (and thus increases the likelihood that there will be a programming error).

$item1=$_POST['item1'];

It might make sense if you had this instead.

$item1=mysql_real_escape_string($_POST['item1']);

Good luck with the project, ~Ray
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 

Author Comment

by:DS928
ID: 39258221
Thank you Ray.  So should I do this for each variable?

$item1=mysql_real_escape_string($_POST['item1']);
0
 
LVL 52

Expert Comment

by:Julian Hansen
ID: 39258551
Each variable would need to be cleaned - a better solution is to use PDO - for two reasons

1. The MySQL lib is about to become extinct
2. The PDO library allows for prepared statements which limits the risks of an injection attack.

You could also migrate to mysqli but you would still need to use mysqli_real_escape_string on your vars.
0
 
LVL 108

Expert Comment

by:Ray Paseur
ID: 39259442
You should follow the guidance on the PHP.net documentation for all PHP functions.  In this case the documentation says, "This function must always (with few exceptions) be used to make data safe before sending a query to MySQL."
http://php.net/manual/en/function.mysql-real-escape-string.php

Information related to the removal of the MySQL extension is available in this article.  It tells why the extension is being removed and what you must do to keep your scripts running.
http://www.experts-exchange.com/Web_Development/Web_Languages-Standards/PHP/PHP_Databases/A_11177-PHP-MySQL-Deprecated-as-of-PHP-5-5-0.html
0
 

Author Closing Comment

by:DS928
ID: 39259515
Thank you.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Foreword In the years since this article was written, numerous hacking attacks have targeted password-protected web sites.  The storage of client passwords has become a subject of much discussion, some of it useful and some of it misguided.  Of cou…
Introduction Since I wrote the original article about Handling Date and Time in PHP and MySQL (http://www.experts-exchange.com/articles/201/Handling-Date-and-Time-in-PHP-and-MySQL.html) several years ago, it seemed like now was a good time to updat…
The viewer will learn how to create and use a small PHP class to apply a watermark to an image. This video shows the viewer the setup for the PHP watermark as well as important coding language. Continue to Part 2 to learn the core code used in creat…
This tutorial will teach you the core code needed to finalize the addition of a watermark to your image. The viewer will use a small PHP class to learn and create a watermark.

895 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now