Android MYSQL Insert doesn't Work

Question

I am attempting to insert an objetc into a table on my database using the following Code:

PHP:

$sql = mysql_query("INSERT INTO order (placer_name, item_name, payment_amount, location_string, location_lat, location_long) VALUES('$_POST[PlacerName]', '$_POST[ItemName]', '$_POST[Payment]', '$_POST[Location]', '$_POST[Lat]', '$_POST[Long]')");     

        if($sql){
             echo 'Success';
        }
        else{
            echo 'Error occured.';
        }
}

JAVA:

 // POST ORDER
    public void order(String nm, String pay, String location) {
        itemName = nm;
        paymentAmount = pay;
        locationString = location;
        if (Utility.getCurrentLocation() != null) {
            handler.post(new Runnable() {
                public void run() {
                    new OrderTask().execute((Void) null);
                }
            });
        } else {
            // Cannot Determine Location
            showMessage("Cannot Determine Location.");
        }
    }

    class OrderTask extends AsyncTask<Void, Void, Boolean> {
        private void postData() {
            if (user.loggedIn) {
                HttpClient httpclient = new DefaultHttpClient();
                HttpPost httppost = new HttpPost(
                        "http://cyberkomm.ch/sidney/php/postOrder.php");
                try {
                    ArrayList<NameValuePair> nameValuePairs = new ArrayList<NameValuePair>(
                            6);
                    nameValuePairs.add(new BasicNameValuePair("PlacerName",
                            user.userName));
                    nameValuePairs.add(new BasicNameValuePair("ItemName",
                            itemName));
                    nameValuePairs.add(new BasicNameValuePair("Payment",
                            paymentAmount));
                    nameValuePairs.add(new BasicNameValuePair("Location",
                            locationString));
                    nameValuePairs.add(new BasicNameValuePair("Long", String
                            .valueOf(user.longitude)));
                    nameValuePairs.add(new BasicNameValuePair("Lat", String
                            .valueOf(user.latitude)));
                    httppost.setEntity(new UrlEncodedFormEntity(nameValuePairs));
                    HttpResponse response = httpclient.execute(httppost);
                    BufferedReader in = new BufferedReader(
                            new InputStreamReader(response.getEntity()
                                    .getContent()));
                    StringBuffer sb = new StringBuffer("");
                    String line = "";
                    while ((line = in.readLine()) != null) {
                        sb.append(line);
                        break;
                    }
                    in.close();
                    responseString = sb.toString();
                    if (responseString.equals("Success")) {
                        // Order Placed
                        showMessage("Success. Order Placed!");
                        user.onPlaced();
                    } else {
                        // Failed
                        showMessage("Failed. " + responseString);
                    }
                } catch (Exception e) {
                    Log.e("log_tag", "Error:  " + e.toString());
                }
            } else {`enter code here`
                // Must Login
                showMessage("Must Login");
            }
        }

        @Override
        protected Boolean doInBackground(Void... params) {
            postData();
            return null;
        }
    }

DATABASE: enter image description here

When I run the code, the sql always returns 'Error Occured', which means that it fails to execute the query:

"INSERT INTO order (placer_name, item_name, payment_amount, location_string, location_lat, location_long) VALUES('$_POST[PlacerName]', '$_POST[ItemName]', '$_POST[Payment]', '$_POST[Location]', '$_POST[Lat]', '$_POST[Long]')"

I checked the syntax, and everything seems to be in order, but I had some guesses as to what could be wrong, but I am not sure:

Type Issues with integers, doubles Parameter Values

Thank you for your help.

score 3 · Accepted Answer · edited May 23 '17 at 12:07

order is a MySQL reserved word.

http://dev.mysql.com/doc/refman/5.5/en/reserved-words.html

either wrap it in backticks, or use another word for it, such as orders, that would be OK.

"INSERT INTO `order`

having error reporting on, would have signaled that.

error_reporting(E_ALL);
ini_set('display_errors', 1);

http://php.net/manual/en/function.error-reporting.php

the SQL error message would have been:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'order

Plus, your present code is open to SQL injection. Use mysqli with prepared statements, or PDO with prepared statements.

Android MYSQL Insert doesn't Work

1 Answers1