PHP/SQL - Incorrect Syntax

Question

I'm new to MySQL Queries. This is what I have so far what did I do wrong?

"INSERT INTO users (ip) WHERE id = '".$_SESSION["user"]["id"]."' 
VALUES ('$ip')"

EDIT

I just was asking about how my syntax was wrong. I understand the vulnerabilities, and did not paste them in my question. I am using the PDO library and mysql_real_string_escape WHENEVER I can...

**warning** your code is extremely vulnerable to sql injection attacks. — Daniel A. White, Nov 26 '12 at 02:07
Trying to take $_SERVER["REMOTE_ADDR"] and place it into the IP field of my database. I'm indicated which row to specify using the user's ID which corresponds with the ID's in the database if they are logged in. — Necro., Nov 26 '12 at 02:11

score 4 · Accepted Answer · answered Nov 26 '12 at 02:11

4

INSERT query is wrong. I think you are updating something and you need to use UPDATE query

UPDATE users SET ip = '$ip' WHERE id = '".$_SESSION["user"]["id"]."'

Also work on fixing sql injection attacks.

answered Nov 26 '12 at 02:11

Muthu Kumaran

17,682
5
47
70

How would I go about fixing the SQL injection? mysql real string escape? – Necro. Nov 26 '12 at 02:15
Yes, use mysql real string escape – Muthu Kumaran Nov 26 '12 at 02:18
use `PDO_MYSQL`, which is more safer than `mySQL`. [PDO_MYSQL](http://php.net/manual/en/ref.pdo-mysql.php) Also check this SO post form more info [MySQL versus PDO](http://stackoverflow.com/questions/866860/mysql-versus-pdo) – Nandakumar V Nov 26 '12 at 02:24

Tigger · Answer 2 · 2012-11-26T02:21:24.513

1

INSERT INTO users (ip) 
VALUES ('value to insert')

or

UPDATE users
SET ip = 'value to update'
WHERE ip = 'value to check'

Also, wrap your value to update and value to insert in a PHP mysqli_real_escape_string($DB,$val)

edited Nov 26 '12 at 02:21

answered Nov 26 '12 at 02:13

Tigger

8,980
5
36
40

score 0 · Answer 3 · edited Nov 26 '12 at 02:33

0

  INSERT INTO table_name (column1, column2, column3,...)
  VALUES (value1, value2, value3,...)
  WHERE column_name operator value

sql injection info

edited Nov 26 '12 at 02:33

nickhar

19,981
12
60
73

answered Nov 26 '12 at 02:12

jsteinmann

4,502
3
17
21

PHP/SQL - Incorrect Syntax

3 Answers3