String cutting off during insert query

Question

Why is this doing what it's doing?

Code:

<?php
    if (isset($_POST['sourceInsert'])) {
        $url = $db_con3->real_escape_string($_POST['url']);
        $desc = $db_con3->real_escape_string($_POST['desc']);
        echo '$urlbefore is ' . $url . '<br />'; ///for troubleshooting
        $result = $db_con3->query("INSERT INTO gdrive_links (evalid, userid, url, desc) VALUES ('$evalid', '$id', '$url', '$desc')");

        echo '$urlafter is ' . $url . '<br />'; ///For troubleshooting
        echo $db_con3->error; ///For troubleshooting
    }
?>

HTML output:

$urlbefore is https://docs.google.com/file/d/0B0tcjQ3FxlB6dWlMTkNQVjBwVDA/edit?usp=sharing
$urlafter is https://docs.google.com/file/d/0B0tcjQ3FxlB6dWlMTkNQVjBwVDA/edit?usp=sharing
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'desc) VALUES ('1284017', '1', 'https://docs.google.com/file/d/0B0tcjQ3FxlB6dWlMT' at line 1

So the string is fine before and after the query string, but in the query it's being cut off at the 49th character. Am I missing something dumb? It looks like my query syntax is correct...

You have `(evalid, userid, url, desc) VALUES ('$evalid', '$id', '$url', '$desc')`, shouldn't that be `(evalid, userid, url, desc) VALUES ('$evalid', '$userid', '$url', '$desc')`? — Funk Forty Niner, May 27 '13 at 02:05

score 4 · Accepted Answer · answered May 27 '13 at 02:12

4

The problem is because, you have a reserved keyword, unescaped.

$result = $db_con3->query("INSERT INTO gdrive_links (`evalid`, `userid`, `url`, `desc`) VALUES ('$evalid', '$id', '$url', '$desc')");

You need to escape them using backticks, this way. desc is a reserved keyword in MySQL. Escape them like above.

answered May 27 '13 at 02:12

Praveen Kumar Purushothaman

164,888
24
203
252

I just changed the field name file_desc and all is working, thanks. – Rich701 May 27 '13 at 02:15
Welcome! If you would like to use `desc` itself, you can use this way. You can copy the code in my answer and paste it in your app to make it work. :) – Praveen Kumar Purushothaman May 27 '13 at 02:16
using an unescaped reserved word should trigger an error, not insert a partial string – May 27 '13 at 02:22
@Dagon It did trigger an error. Please see the output. – Praveen Kumar Purushothaman May 27 '13 at 02:46
1

oh he meant the string was truncated in the error message; well that was quite irrelevant :-) – May 27 '13 at 02:49

String cutting off during insert query

1 Answers1

Linked