SQL syntax error

Discussion in 'PHP' started by samani, Feb 15, 2010.

  1. #1
    hello i need some helpful advice about the following coding. I'm trying to insert data into a database and it is not entering. here are the following codes for the pages im using.

    Add.php
    
    <form action="insertrecord.php" method="post">
    				
    <p>Name of Game: <input type="text" name="entergamename">
    <? if($error1==1){
    echo"<font color='red'>*Try Again</font>";
    }
    ?><br>
    
    Published by: <input type="text" name="enterpublish"><br>
    
    Genre: <input type="text" name="entergenre"><br>
    
    Age rating:<input type="text" name="enterage"><br>
    
    Year of Release: <input type="text" name="enterrelease">
    <? if($error2==1){
    echo"<font color='red'>*Try Again</font>";}
    ?><br>
    
    Console: <input type="text" name="enterconsole">
    <? if($error3==1){
    echo"<font color='red'>*Try Again</font>";
    }
    ?><br>
    
    Review:<br>
    <textarea rows="10" cols="30" name="enterreview"></textarea><br>
    
    Rating: <input type="text" size="3" name="enterrate">/5<br><br>
    					
    <input type="submit" value="Submit" /></p>
    </form>
    
    Code (markup):
    Insertrecord.php
    
    <?
    include ("conninfo.php");
    	
    $error1=0;
    $error2=0;
    $error3=0;
    	
    $usergamename=$_POST["entergamename"];
    $userpublisher=$_POST["enterpublish"];
    $usergenre=$_POST["entergenre"];
    $userage=$_POST["enterage"];
    $useryear=$_POST["enterrelease"];
    $userconsole=$_POST["enterconsole"];
    $userreview=$_POST["enterreview"];
    $userrate=$_POST["enterrate"];
    
    if($usergamename==""){//check gamename for blanks
    $error1=1;
    }
    		
    if($useryear==""){//check year for blanks
    $error2=1;
    }
    if($userconsole==""){//check year for blanks
    $error3=1;
    }
    		
    if(($error1==1)||($error2==1)||($error3==1)){
    header("location:add.php?a=$error1&b=$error2&c=$error3");
    }
    		
    else{
    $query="INSERT INTO gamedata(Gamename,Publisher,Genre,Age,Release,Console,Review,Rating) VALUES('$usergamename',$userpublisher,$usergenre,$userage,$useryear,$userconsole,'$userreview',$userrate)";
    $result=mysql_query($query) or die ("couldn't execute query".mysql_error());
    }
    ?>
    
    Code (markup):
    The error im gettin on the insertrecord.php file is the following
    I'm not sure what on earth is goin on here iv re written the code and its the same thing. I'm using wampserver 2.0.
     
    samani, Feb 15, 2010 IP
  2. danx10

    danx10 Peon

    Messages:
    1,179
    Likes Received:
    44
    Best Answers:
    2
    Trophy Points:
    0
    #2
    I've cleaned up your code; try this.

    insertrecord.php

    <?php
      error_reporting(E_ALL);
      include("conninfo.php");
      
      $error1 = 0;
      $error2 = 0;
      $error3 = 0;
      
      //added mysql_real_escape_string to secure....
      $usergamename = mysql_real_escape_string($_POST["entergamename"]);
      $userpublisher = mysql_real_escape_string($_POST["enterpublish"]);
      $usergenre = mysql_real_escape_string($_POST["entergenre"]);
      $userage = mysql_real_escape_string($_POST["enterage"]);
      $useryear = mysql_real_escape_string($_POST["enterrelease"]);
      $userconsole = mysql_real_escape_string($_POST["enterconsole"]);
      $userreview = mysql_real_escape_string($_POST["enterreview"]);
      $userrate = mysql_real_escape_string($_POST["enterrate"]);
      
      if (empty($usergamename)) {
          //check gamename for blanks
          $error1 = 1;
      }
      
      if (empty($useryear)) {
          //check year for blanks
          $error2 = 1;
      }
      if (empty($userconsole)) {
          //check year for blanks
          $error3 = 1;
      }
      
      if ($error1 == 1 || $error2 == 1 || $error3 == 1) {
          header("location:add.php?a=$error1&b=$error2&c=$error3");
      }
      
      else {
          
          mysql_query("INSERT INTO gamedata (Gamename, Publisher, Genre, Age, Release, Console, Review, Rating) VALUES('$usergamename','$userpublisher','$usergenre','$userage','$useryear','$userconsole','$userreview','$userrate') ") or die(mysql_error());  
    
      }
    ?>
    PHP:
    You should remember, to sanitize all user submited data before parsing it into the db. Report back if you get any further errors.
     
    Last edited: Feb 15, 2010
    danx10, Feb 15, 2010 IP
  3. samani

    samani Peon

    Messages:
    2
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #3
    I'm still getting the error
    It could be liked to the column name's but it doesn't make sense because the other columns would have to be effected as well. wouldn't it?
     
    samani, Feb 15, 2010 IP
  4. danx10

    danx10 Peon

    Messages:
    1,179
    Likes Received:
    44
    Best Answers:
    2
    Trophy Points:
    0
    #4
    Hmmm..

    Are you sure all column names are valid (ie. all columns exists?), and that your entering a value for all?

    Also, post edited, try the code now.
     
    danx10, Feb 15, 2010 IP