Solved

MySQL Error

Posted on 2013-06-18
7
387 Views
Last Modified: 2013-06-19
I'm having a problem finding the error in this code.  This is the error.

Database error: Invalid SQL: SELECT * FROM customer_order where orderId= Database error: Invalid SQL: INSERT INTO customer_order (RestId,streetnumber,streetname,cross,apt,city,state,zip,latestProcessStatus,summary,OrderDate,DeliveryTime,PayStatus, comments,OrderPolicyId,lastname,firstname,phone) VALUES (2,\"Street Number\",\"Street Name\",\"Cross Street\",\"Apt Number\",\"City\",\"State\",\"Zip Code\",\"pending\", \"no summery\", NOW(),\"8:00PM\",\"1\",\"\",\"1\",\"Last Name\",\"First Name\",\"212.222.2222\")
nMySQL Error: 1064 (You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near \'cross,apt,city,state,zip,latestProcessStatus,summary,OrderDate,DeliveryTime,PayS\' at line 1)
nSession halted.
nMySQL Error: 1064 (You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Database error: Invalid SQL: INSERT INTO customer_order' at line 1)
nSession halted.






$item1=$_POST['item1'];
$streetnumber=$_POST['streetnumber'];
$streetname=$_POST['streetname'];
$cross=$_POST['cross'];
$apt=$_POST['apt'];
$city=$_POST['city'];
$state=$_POST['state'];
$zip=$_POST['zip'];
$deliverytime=$_POST['deliverytime'];
$paystatus = ($_POST['paymethod'] == '')?'1':'2';
$comments = $_POST['comments'];
$OrderPolicyId = $_POST['ordertype'];
$lastname = $_POST['lastname'];
$firstname = $_POST['firstname'];
$phone = $_POST['phone'];
include ('includes/database.php');
$db = new Database;

$sql_insert_order='INSERT INTO customer_order (RestId,streetnumber,streetname,cross,apt,city,state,zip,latestProcessStatus,summary,OrderDate,DeliveryTime,PayStatus, comments,OrderPolicyId,lastname,firstname,phone)
VALUES (2,"'.$streetnumber.'","'.$streetname.'","'.$cross.'","'.$apt.'","'.$city.'","'.$state.'","'.$zip.'","pending", "no summery", NOW(),"'.$deliverytime.'","'.$paystatus.'","'.$comments.'","'.$OrderPolicyId.'","'.$lastname.'","'.$firstname.'","'.$phone.'")';

Open in new window

0
Comment
Question by:DS928
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 83

Expert Comment

by:Dave Baldwin
ID: 39258056
That's confusing.  Your text and the code you posted are about two different things.  How do you get a SELECT and an INSERT into the same error message?
0
 

Author Comment

by:DS928
ID: 39258069
Sure is Dave.  Found the problem.  Had an extra field in there.  "Pay Status"
0
 
LVL 110

Accepted Solution

by:
Ray Paseur earned 500 total points
ID: 39258132
Just for future reference, a statement like this does nothing but propagate a variable (and thus increases the likelihood that there will be a programming error).

$item1=$_POST['item1'];

It might make sense if you had this instead.

$item1=mysql_real_escape_string($_POST['item1']);

Good luck with the project, ~Ray
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 

Author Comment

by:DS928
ID: 39258221
Thank you Ray.  So should I do this for each variable?

$item1=mysql_real_escape_string($_POST['item1']);
0
 
LVL 58

Expert Comment

by:Julian Hansen
ID: 39258551
Each variable would need to be cleaned - a better solution is to use PDO - for two reasons

1. The MySQL lib is about to become extinct
2. The PDO library allows for prepared statements which limits the risks of an injection attack.

You could also migrate to mysqli but you would still need to use mysqli_real_escape_string on your vars.
0
 
LVL 110

Expert Comment

by:Ray Paseur
ID: 39259442
You should follow the guidance on the PHP.net documentation for all PHP functions.  In this case the documentation says, "This function must always (with few exceptions) be used to make data safe before sending a query to MySQL."
http://php.net/manual/en/function.mysql-real-escape-string.php

Information related to the removal of the MySQL extension is available in this article.  It tells why the extension is being removed and what you must do to keep your scripts running.
http://www.experts-exchange.com/Web_Development/Web_Languages-Standards/PHP/PHP_Databases/A_11177-PHP-MySQL-Deprecated-as-of-PHP-5-5-0.html
0
 

Author Closing Comment

by:DS928
ID: 39259515
Thank you.
0

Featured Post

Will your db performance match your db growth?

In Percona’s white paper “Performance at Scale: Keeping Your Database on Its Toes,” we take a high-level approach to what you need to think about when planning for database scalability.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Nothing in an HTTP request can be trusted, including HTTP headers and form data.  A form token is a tool that can be used to guard against request forgeries (CSRF).  This article shows an improved approach to form tokens, making it more difficult to…
Introduction This article is intended for those who are new to PHP error handling (https://www.experts-exchange.com/articles/11769/And-by-the-way-I-am-New-to-PHP.html).  It addresses one of the most common problems that plague beginning PHP develop…
The viewer will learn how to look for a specific file type in a local or remote server directory using PHP.
This tutorial will teach you the core code needed to finalize the addition of a watermark to your image. The viewer will use a small PHP class to learn and create a watermark.

632 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question