0

I have this sql string:

$sql = "INSERT INTO foto (id, nome, check)
            VALUES ('', '" . md5($file) . '.' .$Type. "', '" . md5($file2) . '.' .$Type2. "')";

but it returns this error:

INSERT INTO foto (nome, check) VALUES ('57f030f902b9fbd6907d1af52ec2a1ba.jpg', '8c96b1254a72dbd080a9b79a9a224865.jpg')
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'check) VALUES ('57f030f902b9fbd6907d1af52ec2a1ba.jpg', '8c96b1254a72dbd080a9' at line 1

'

md5($file) + $Type = 57f030f902b9fbd6907d1af52ec2a1ba.jpg
md5($file2) + $Type2 = 8c96b1254a72dbd080a9b79a9a224865.jpg

What's the problem? How can I solve it?

Rasclatt
  • 12,498
  • 3
  • 25
  • 33
MR10
  • 3
  • 1
  • You really should be using SQL placeholders like `?` or `:nome` for this, because the way you're composing this query string seems completely reckless. Are any of those values even [properly escaped](http://bobby-tablesl.com/php)? – tadman Nov 07 '14 at 18:23

1 Answers1

3

check is a MySQL reserved word

which requires it to be wrapped in backticks, or rename it to checks for example in your table.

$sql = "INSERT INTO foto (id, nome, `check`)

if you want to rename it, then just do

$sql = "INSERT INTO foto (id, nome, checks)

which won't throw an error; the option is yours.

Notice where the error starts and points to:

>...MySQL server version for the right syntax to use near 'check
                                                          ^ starts there

Plus, once you've fixed that, your code would still be open to SQL injection.
Use mysqli with prepared statements, or PDO with prepared statements, they're much safer.

Community
  • 1
  • 1
Funk Forty Niner
  • 74,450
  • 15
  • 68
  • 141
  • Thank you. "check" was the problem. I know that is an unsafe query but it is inside a secure and private area of the website in which only one person can enter. I will, however, once finished the entire code, make sure this area too. Thank you very much. – MR10 Nov 07 '14 at 18:46