-2

Here is my code:

$sql="INSERT INTO reg ('name','email','add',c_no,'user_name','pass','mess')
VALUES
('$_POST[name]','$_POST[email]','$_POST[add]','$_POST[number]','$_POST[user]','$_POST[pass]','$_POST[comment]')";

The error I get is:

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''name','email','add',c_no,'user_name','pass','mess') VALUES ('admin','swapni' at line 1

halfer
  • 19,824
  • 17
  • 99
  • 186
user3302950
  • 87
  • 1
  • 2
  • 8
  • 3
    1. You have a SQL injection vulnerability; 2. You shouldn't store unhashed passwords in your database. Learn about password hashing, salting and bcrypt. – luiscubal Oct 09 '13 at 20:09

5 Answers5

1

You can't use ' sign in column names, instead use backtick ` or skip it if field name is not reserved keyword.

Also instead of putting $_POST variables into sql, read about prepared statements and always check input data.

Elon Than
  • 9,603
  • 4
  • 27
  • 37
1

First of all, your code is vulnerable to SQL Injection: How can I prevent SQL injection in PHP?

And your field names are encapsulated with ', they should be with ` or nothing if they don't match MySQL reserved words.

Third mysql_* are deprecated: Why shouldn't I use mysql_* functions in PHP?

Fourth: "...('$_POST['something']','..." is very bad practice, I don't think that it'll work in the latest PHP and you should strongly consider to write it like "...('" . $text_to_insert . "','..."

Solution to all of this problems in MySQLi:

$db=new mysqli("server","username","password","database");
$insert_stmt=$db->prepare("INSERT INTO reg (name,email,add,c_no,user_name,pass,mess) VALUES (?,?,?,?,?,?,?)");
$insert_stmt->bindParam("sssisss",$_POST["name"],$_POST["email"],$_POST["add"],$_POST["c_no"],$_POST["user_name"],$_POST["pass"],$_POST["mess"]);
$is_successful=$insert_stmt->execute();
Community
  • 1
  • 1
Lorenz
  • 2,179
  • 3
  • 19
  • 18
0

Column names should be encapsulated with backticks, not quotes.

$sql="INSERT INTO reg (`name`,`email`,`add`,`c_no`,`user_name`,`pass`,`mess`)
VALUES ('$_POST[name]','$_POST[email]','$_POST[add]','$_POST[number]','$_POST[user]','$_POST[pass]','    $_POST[comment]')";
aynber
  • 22,380
  • 8
  • 50
  • 63
0

Hey i am using between operator for the fetching data from date to date.

Query is....

SELECTcustomer.*,feedback.*,feedback.idas fid FROM (feedback) LEFT OUTER JOINcustomerONcustomer.feedbackID=feedback.id WHEREfeedback.spa_id= '1' ANDfeedback.Overall_rating!= '' ANDfeedback.fb_dateBETWEEN "2014-06-01" and "2015-10-30"

using this query i am unable to fetch the data for the date "2015-10-30"

Thank You.

user3302950
  • 87
  • 1
  • 2
  • 8
-4
$name = mysql_real_escape_string($_POST['name']);
$email = mysql_real_escape_string($_POST['email']);
$add = mysql_real_escape_string($_POST['add']);
$c_no = mysql_real_escape_string($_POST['c_no']);
$user_name = mysql_real_escape_string($_POST['user_name']);
$pass = mysql_real_escape_string($_POST['pass']);
$mess = mysql_real_escape_string($_POST['mess']);

$sql= "INSERT INTO reg (`name`,`email`,`add`,`c_no`,`user_name`,`pass`,`mess`) 
VALUES($name,$email,$add,$c_no,$user_name,$pass,$mess)";
DanielDake
  • 25
  • 1
  • 10
  • You make the same mistake again, putting the field name in ' '! – Lorenz Oct 09 '13 at 20:10
  • Ok, let's ignore it's stupid to use `$_POST` in queries. PHP will not allow using `"` or `'` inside string when accessing arrays. – Elon Than Oct 09 '13 at 20:10
  • You've quoted the `$_POST` array index, which at least will suppress a warning, but left a SQL injection vulnerability in there. Ah yes, and you've broken out of the string using single quotes, rather than double quotes, and omitted the last string-closing quote after the bracket. – halfer Oct 09 '13 at 20:12