Problematic MySQL Query

Discussion in 'PHP' started by MetaTitan, Dec 23, 2007.

  1. #1
    Having some problems and can't figure out why for the life of me,

    		$name = mysql_real_escape_string($_POST['add_name']);
    		$series = mysql_real_escape_string($_POST['add_series']);
    
    		$query = "SELECT * from `releases` 
    				  WHERE name='$name' 
    				  AND series='$series'";
    		$result = mysql_query($query);
    		$num_rows = mysql_num_rows($result);
    		while ($row = mysql_fetch_object($result)){
    			$queue_status = $row->modqueue;
    		}
    		if ($num_rows != 0) { 
    			if ($queue_status == 1) { mserror("Already submitted, pending review."); }
    			else { mserror("Already exists in our database."); }
    		}
    PHP:
    This little snippet is running on a submission form for a certain project. The problem I'm having is it's being bypassed when I have the AND series='$series' clause. There is a series field on the table, it's INT(13), and my script completely ignores the rules I've set despite everything looking ok from my end.

    My form is set up properly as well because it IS saving the right variable for series into the table on an INSERT query that follows this. mserror is my error function that is supposed to print the message and then exit();, it's working properly in other sections of the script.

    Anything I'm missing?

    edit: I debugged and found this is the error it's spitting out:

     
    MetaTitan, Dec 23, 2007 IP
  2. kmap

    kmap Well-Known Member

    Messages:
    2,215
    Likes Received:
    29
    Best Answers:
    2
    Trophy Points:
    135
    #2
    What error you are getting

    Regards

    Alex
     
    kmap, Dec 23, 2007 IP
  3. hogan_h

    hogan_h Peon

    Messages:
    199
    Likes Received:
    30
    Best Answers:
    0
    Trophy Points:
    0
    #3
    Try removing single quotes around $series, because an int number is expected.
     
    hogan_h, Dec 23, 2007 IP
  4. MetaTitan

    MetaTitan Peon

    Messages:
    141
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    0
    #4
    hogan_h, I've tried that, no dice :(
    kmap, edited the error into the original post.
     
    MetaTitan, Dec 23, 2007 IP
  5. Vio82

    Vio82 Peon

    Messages:
    27
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #5
    Better check $series, is not correct i think. Also use intval() for int values (AND series='".intval($series)."'";)
     
    Vio82, Dec 23, 2007 IP
  6. hogan_h

    hogan_h Peon

    Messages:
    199
    Likes Received:
    30
    Best Answers:
    0
    Trophy Points:
    0
    #6
    Usually when i'm having issues like this, i echo "query" statement, copy it and paste it into phpmyadmin and try to see what errors are. Then i generate with phpmyadmin a valid query statement using same fields/criteria and compare the two statements what is different and how should i modify the original query to make them look and behave the same.
     
    hogan_h, Dec 23, 2007 IP
    MetaTitan likes this.
  7. MetaTitan

    MetaTitan Peon

    Messages:
    141
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    0
    #7
    Vio82, I tried popping intval into it and it didn't work.

    hogan_h, I'll give it a try.
     
    MetaTitan, Dec 23, 2007 IP
  8. MetaTitan

    MetaTitan Peon

    Messages:
    141
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    0
    #8
    Fixed! I played around in phpMyAdmin and changing series to `series` on the query has done the trick.

    Thanks hogan_h, and everyone else.
     
    MetaTitan, Dec 23, 2007 IP
    hogan_h likes this.
  9. InFloW

    InFloW Peon

    Messages:
    1,488
    Likes Received:
    39
    Best Answers:
    0
    Trophy Points:
    0
    #9
    Well then just so you understand this if you do not. I imagine series is actually a reserved sql word as a result when you put series it's thinking something else. So using ` around it tells it that it's not the reserved word series which is probably a sql function of some kind.
     
    InFloW, Dec 23, 2007 IP