What does this mysql error means? - mysql

Question

I get the following error:
1064 You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use
near 'AND `hackcount` >= 3' at line 1 SQL=SELECT COUNT(*) from
`xxxxx_mi_iptable` WHERE ip = AND `hackcount` >= 3
What does this mean? What should I do to fix this?

Answer 1

There's an error in your WHERE clause:
WHERE ip = AND `hackcount` >= 3
Where ip equals what, exactly? You forgot to put a value there.

Answer 2

Looks like you're using Joomla plugin "Marco's SQL Injection" (http://www.mmleoni.net/sql-iniection-lfi-protection-plugin-for-joomla).
It has a line that tries to detect the IP of the current client
$remoteIP = $_SERVER['REMOTE_ADDR'];
Because REMOTE_ADDR is not always present/reliable/sufficient the following SQL query
$sql = "SELECT COUNT(*) from `#__mi_iptable` WHERE ip = '{$remoteIP}' AND `hackcount` >= {$this->p_ipBlockCount}" ;
fails.
the plugin should use something like this
if (isset($_SERVER['REMOTE_ADDR']))
{
$remoteIP = $_SERVER['REMOTE_ADDR'];
}
elseif (isset($_SERVER['HTTP_X_FORWARDED_FOR']))
{
$remoteIP = $_SERVER['HTTP_X_FORWARDED_FOR'];
}
elseif (isset($_SERVER['HTTP_CLIENT_IP']))
{
$remoteIP = $_SERVER['HTTP_CLIENT_IP'];
}