PHP script syntax error

Question

I am having a problem with PHP (am very inexperienced with it) and I am getting the below error. Could anyone help me find the cause of the below error.

Parse error: syntax error, unexpected '' (T_ENCAPSED_AND_WHITESPACE), expecting identifier (T_STRING) or variable (T_VARIABLE) or number (T_NUM_STRING) in /home/jsnow/projects/one/htdocs/edit-exec.php on line 30

My Code:

$dbconn = mysql_select_db(APP_DB);
if(!$dbconn) 
{ 
    die("ERROR SELECTING DB"); 
}

$query = "SELECT * FROM users WHERE users_id='$_SESSION['SESS_USER_ID']'"; 
$result = @mysql_query($query);

if($result) { 
    header("location: success-register.php");  
    exit();
}else { 
    die("Query failed");  
}

I am not sure if its something obvious but I cant see it.

Any help would be very appreciative.

Also, u should use prepared statements for better performance and better security — Tearsdontfalls, Jan 20 '13 at 16:16

Craig Taub · Accepted Answer · 2013-01-20T15:54:31.480

2

The above code has not been very well written.

You are probably better off using something like PDO instead of the below.

However the problem is most likely with the ' inside of $query.

Try the below.

$dbconn = mysql_select_db(APP_DB);
if(!$dbconn) {
    die("ERROR SELECTING DB");
}

$query = "SELECT * FROM users WHERE users_id='".$_SESSION['SESS_USER_ID']."'";
$result = @mysql_query($query);

if($result) {
   header("location: success-register.php");
   exit();
}else {
   die("Problem registering");
}

That would fix the code but I would recommend using something like the below instead (will add params later and satanize ensuring protection from sql injection):

$dbh = new PDO("database details");
$sth = $dbh->prepare('SELECT * FROM users WHERE users_id=:users_id');
$sth->bindParam(':users_id', $_SESSION['SESS_USER_ID']);
$sth->execute();

edited Jan 20 '13 at 15:54

answered Jan 20 '13 at 15:43

Craig Taub

4,169
1
19
25

Thanks this is most helpful. – John Snow Jan 20 '13 at 15:46
what is this `SET name='[".$full_name."]'`? – John Woo Jan 20 '13 at 15:46
yeah prob a typo from the question...code above still applies (just remove the SET part) – Craig Taub Jan 20 '13 at 15:48
the SET part is not meant to be there. – John Snow Jan 20 '13 at 15:53
hi, have made an edit to my answer and to your question @JohnSnow – Craig Taub Jan 20 '13 at 15:55

score 1 · Answer 2 · answered Jan 20 '13 at 15:44

1

$query = "SELECT * FROM users WHERE name = '".$full_name."' AND users_id = '".$_SESSION['SESS_USER_ID']."'";

answered Jan 20 '13 at 15:44

Tommaso Belluzzo

23,232
8
74
98

what is this `SET name='[".$full_name."]'`? – John Woo Jan 20 '13 at 15:45
Ops didn't noticed that one! – Tommaso Belluzzo Jan 20 '13 at 15:47

PHP script syntax error

2 Answers2