Parse error: syntax error, unexpected T_CONSTANT_ENCAPSED_STRING in your code PHP

Question

$sSql = "INSERT INTO comments
     ( post_id,name, email, website,content)
     VALUES (".$_POST[postid]",'".$_POST[name]"', '".$_POST[email]"', '"$_POST[website]"',  '"$_POST[content]"')";

I am getting the following error. Can anyone help to fix this? Parse error: syntax error, unexpected T_CONSTANT_ENCAPSED_STRING in your code

**warning** your code is extremely vulnerable to sql injection attacks. consider using a prepared statement, which would solve your problems. — Daniel A. White, Jul 09 '12 at 00:00

score 2 · Answer 1 · answered Jul 09 '12 at 00:01

2

Your strings aren't concatenated properly, you are missing some . before and after some $_POST[]

answered Jul 09 '12 at 00:01

Musa

96,336
17
118
137

score 0 · Answer 2 · edited May 23 '17 at 10:09

0

Error was in string concatenation missing . and array missing qoutes

$sSql = "INSERT INTO comments
 ( post_id,name, email, website,content)
 VALUES (".$_POST['postid'].",'".$_POST['name']."', '".$_POST['email']."', '".$_POST['website']."',  '".$_POST['content']."')";

Use mysql_escape_string to avoid sql injection and best way to avoid sql injection.

edited May 23 '17 at 10:09

Community

1
1

answered Jul 09 '12 at 00:00

The Alpha

143,660
29
287
307

score 0 · Answer 3 · answered Jul 09 '12 at 00:00

0

You need to wrap with two periods. .$_POST[postid].

Also, make sure you escapting your $_POST parameters as it may be subject to SQL injection.

answered Jul 09 '12 at 00:00

Steven Lu

2,150
1
24
33

score 0 · Answer 4 · answered Jul 09 '12 at 00:01

0

$_POST should be used as an associative array. So the keys should in quotes : $_POST['key']

answered Jul 09 '12 at 00:01

Razvan

9,925
6
38
51

score 0 · Answer 5 · answered Jul 09 '12 at 00:01

It's because you forgot some dots - unexpected strings are starting in your query.

$sSql = "INSERT INTO comments
     ( post_id,name, email, website,content)
     VALUES (".$_POST['postid'].",'".$_POST['name']."', '".$_POST['email']."', '".$_POST['website']."',  '".$_POST['content']."')";

Please escape userinputs before putting it into database. And take care of the arraykeys: it works without setting them into '' because php takes them as constants, can't find a defined constant of this name, and assumes that this has to be a string. Unnecessary.

score 0 · Answer 6 · answered Apr 04 '13 at 10:57

0

Please use this. You forget quotes and dotes.

$sSql = "INSERT INTO comments ( post_id,name, email, website,content) VALUES (".$_POST['postid'].",'".$_POST['name']."', '".$_POST['email']."', '".$_POST['website']."',  '".$_POST['content']."')";

answered Apr 04 '13 at 10:57

Bharat Chodvadiya

1,644
4
20
31

Parse error: syntax error, unexpected T_CONSTANT_ENCAPSED_STRING in your code PHP

6 Answers6