Hey I'm tring the following sql query :
$sql = mysql_query("INSERT INTO feeds (FileLocation,Title,feeddate,nameofuploader,type)
VALUES('".mysql_real_escape_string($putItAt)."','".mysql_real_escape_string($_POST['title'])." ',now(),". $_SESSION['name'] .",'file')")
but its giving me the error:
Unknown column 'Ankit2' in 'field list'
where Ankit2 is the value to be inserted
Any way around this?
You forgot to put single quotes around the $_SESSION variable!
$sql = mysql_query("INSERT INTO feeds (FileLocation,Title,feeddate,nameofuploader,type)
VALUES('".mysql_real_escape_string($putItAt)."','".mysql_real_escape_string($_POST['title'])." ',now(),'". $_SESSION['name'] ."','file')")
Is the sql string right? Please try this to check your sql string:
$sql_str = "INSERT INTO feeds (FileLocation,Title,feeddate,nameofuploader,type) VALUES('".mysql_real_escape_string($putItAt)."','".mysql_real_escape_string($_POST['title'])." ',now(),". $_SESSION['name'] .",'file')"；
print $sql_str;
to check the sql_st
Related
I've read almost every single thread around the net about the Unknown column 'dfsd' in 'where clause
the dfsd is the string that I entered through a html form using the post method..
the php file(where the forms data are being sent) just checks if the line above is an existing user name.
function authCheck($usr,$psw){
print $usr;
mysql_real_escape_string($usr);
$sql = "select usrNameMarket from marketusr where usrNameMarket=$usr";
$result = mysql_query($sql) or die(mysql_error());
$records=mysql_num_rows($result); //elenxw gia eggrafes
if($records){
$queryData=mysql_fetch_array($result);
if($queryData['usrNameMarket']==$usr){
$usrNameChk="ok";
}
else{
$usrNameChk=null;
}
}
else{
$usrNameChk=null;
}
rest of the file ....
I get the error from MySQL telling me the column doesn't exist (although the value has been passed correctly, that's why I used the print function just to double check it)...
I add the single quotes:
$sql = "select usrNameMarket from marketusr where usrNameMarket='$usr'";
Then I get a syntax error when mysql_query executes...
Then I tried
$sql = "select usrNameMarket from marketusr where usrNameMarket='".$usr."'";
Still I get the same syntax error.
I don't know what is wrong I've tried everything...
Is it possible that I get that error because of the database structure or scheme or the data type of that field(which is varchar)?
Use marketusr.usrNameMarket instead of just usrNameMarket
try with:
$sql = "select usrNameMarket from marketusr where usrNameMarket='$usr'";
This question already has answers here:
Closed 10 years ago.
Possible Duplicate:
Best way to prevent SQL Injection in PHP
What is the best way to escape strings when making a query?
mysql_real_escape_string() seems good but I do not exactly know how to use it in properly.
Does this code do the job properly?
<?php
/* Let's say that the user types "'#""#''"\{(})#&/\€ in a textfield */
$newStr = mysql_real_escape_string($str);
$query = "INSERT INTO table username VALUES ($str)";
mysql_query($query);
?>
EDIT:
Now I have this code:
$email = $_POST['email'];
$displayName = $_POST['displayName'];
$pass = $_POST['pass1'];
$email = mysqli_real_escape_string($link, $email);
$displayName = mysqli_real_escape_string($link, $displayName);
$pass = mysqli_real_escape_string($link, $pass);
$insert = "INSERT INTO profiles (email, displayName, password)
VALUES ('$email', '$displayName', md5('$pass'))";
mysqli_query($link, $insert)
or die(mysqli_error($link));
But I get this error:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '!"#!#^!"#!"#!"#^'''''' at line 1
If the user enters:
'**!"#!#^!"#!"*#!"#^''''
The best way is not to escape the string at all, but instead use a parameterized query, which does it for you behind the scenes.
Using mysql_real_escape_string like that will work, but you need to:
Add quotes around the value.
Use the result $newStr, not the original value $str.
Change the tablename to a name that isn't a reserved keyword.
Add parentheses around the column list.
Try this:
$query = "INSERT INTO yourtable (username) VALUES ('$newStr')";
I also suggest that you check the result of mysql_query($query) and if there is an error, you can examine the error message:
if (!mysql_query($query))
{
trigger_error(mysql_error());
}
You should also consider using one of the newer interfaces to MySQL. The old mysql_* functions are deprecated and should not be used in new code.
just having some trouble with an SQL update in PHP. Listed below is an extract of the function:
$captain = $this->getUserName();
$member = $textParts[1];
$memberNo = 'member1';
$sqlUpdate = 'UPDATE ajax_chat_draft_teams SET '.$memberNo.'='.$member.' WHERE captain='.$captain.'';
$result = $this->db->sqlQuery($sqlUpdate);
When the Query is reached it throws the following error:
Query: UPDATE ajax_chat_draft_teams SET member1=user WHERE captain=Oolius
Error-Report: Unknown column 'Oolius' in 'where clause'
Error-Code: 1054 error occured!
The table ajax_chat_draft_teams has 5 fields: captain, member1, member2, member3, member4
(Note: There is a record in the table where the captain is Oolius and all members are NULL).
I'm failing to see what is wrong with my SQL statement. Thanks for your time.
Try this:
$sqlUpdate = 'UPDATE ajax_chat_draft_teams SET '.$memberNo.' = "'.$member.'" WHERE captain = "'.$captain.'"';
String literals need to be surrounded in single quotes. The query should look like this:
UPDATE ajax_chat_draft_teams SET member1='user' WHERE captain = 'Oolius'
Also, consider using PDO and bind variables.
You need to put Oolius in quotes other MySQL thinks it is a column name.
Use this
$sqlUpdate = 'UPDATE ajax_chat_draft_teams SET
'.$memberNo.'="'.$member.'" WHERE captain="'.$captain.'"';
i hope it will help you.
My query is throwing up this error. Can anyone see why?
$query = "SELECT * FROM Units WHERE ID = `$uniqueUnits[a]`";
Unknown column '' in 'where clause'
Two problems.
You're using backticks to delimit a string. Backticks delimit fields, so MySQL thinks you're trying to give it a column name.
The error message indicates that, in fact, this value that it thinks is a column name, is empty. So your value $uniqueUnits[a] is probably broken, or not being interpolated correctly.
You should do the following:
Interpolate your variables explictly with the "complex syntax" to be sure that the string forms properly;
Check the value of $query so that you can see what's going on:
print $query;
Use actual quotation marks to delimit strings:
$query = "SELECT * FROM Units WHERE ID = '{$uniqueUnits[a]}'";
// ^ quote
// ^ PHP variable interpolation
try
$query = "SELECT * FROM Units WHERE ID = '$uniqueUnits[a]'";
^--- ^---
Backticks are for escaping reserved words, so mysql is translating your variable's contents into a field name.
Because apparently $uniqueUnits[a] resolves to the empty string. And there is no column like this in the database.
Try surrounding your array with {}, like this:
$query = "SELECT * FROM Units WHERE ID = `{$uniqueUnits[a]}`";
Also, is column ID actually in your table?
I'm new to CodeIgniter and I get an error I cannot understand.
This is the code that give the error:
$data = array('adr' => $address);
$this->db->where('id', $id);
$this->db->update('domains', $data);
The error is:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '://www.example.com WHERE id = '10'' at line 1
This is the query:
UPDATE `domains` SET `adr` = http://www.example.com WHERE `id` = '10'
If I change this to
UPDATE `domains` SET `adr` = 'http://www.example.com' WHERE `id` = '10'
it works. Why is CodeIgniter creating this erroneous query?
Try escaping the single quotes in the $address variable before you call the update method.
Generally the CodeIgniter will automatically surround the value of $address with a single quote. I do not know why did you get this error message?
Curious, see if it works when you escape the string use $this->db->escape()
$data = array('adr' => $this->db->escape($address));
$this->db->where('id', $id);
$this->db->update('domains', $data);
I have the same problem and codeigniter do not add single qoutes to where clause.
When you enter integer value, sql do not give error but when you put string value (as a variable) to where clause, it gives error. But when you add single quotes to query and run it on phpmyadmin, it works.
So the solution is adding (string) statement to your variable: as in this (string)$id
I wrote before to add single quotes to variable as '$id', but this will not going to work (I'm new to codeigniter&php, thanks to commenter Mitchell McKenna, I checked out what I wrote before)