Error in sql query syntax

Question

I got this error when i want to click on details:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'and sq.testid=5),0) as om from student as s,test as t, subject as sub,studenttes' at line 1

$result=executeQuery("select s.stdname,s.nume_student,s.prenume_student,
         t.testname, t.testdesc,sub.subname,sub.subdesc,sub.an,
         DATE_FORMAT(st.starttime,'%d %M %Y ') as stime,
         DATE_FORMAT(st.starttime,' %H:%i:%s') as stimes,
         TIMEDIFF(st.endtime,st.starttime) as dur,
         (select sum(marks) 
              from question 
                where testid=".$_REQUEST['details'].") as tm,
         IFNULL((select sum(q.marks) 
              from studentquestion as sq, question as q 
                 where sq.testid=q.testid and sq.qnid=q.qnid 
                    and sq.answered='answered' and sq.stdanswer=q.correctanswer 
                    and sq.stdid=".$_REQUEST['stdid']."  
                    and sq.testid=".$_REQUEST['details']."),0) as om 
             from student as s,test as t, subject as sub,studenttest as st 
                where s.stdid=st.stdid and st.testid=t.testid 
                   and t.subid=sub.subid and st.stdid=".$_REQUEST['stdid']." 
                   and st.testid=".$_REQUEST['details'].";") ;

I know that the problem is sq.stdid=".$_REQUEST['stdid']." and st.stdid=".$_REQUEST['stdid']." but i have no idea how to resolve it.

Whenever you edit..please try to remove scroll...it's very irritating — Nagendra Nigade, May 20 '15 at 08:35
SQL injection spotted. Wrong `)` spotted. Poor table design spotted :( — Daniel W., May 20 '15 at 08:41
Not related to your question, but if you are using `$_REQUEST`, you should have a look here: http://stackoverflow.com/questions/2142497/whats-wrong-with-using-request — Lupin, May 20 '15 at 08:43

score 0 · Answer 1 · answered May 20 '15 at 08:41

0

A typical way for debugging would be to print out the generated query.

From what i see (and from the error message you get) it seems taht here:

nd sq.testid=".$_REQUEST['details']."),0) as om

the closing ) before ,0) seems to be wrong.

answered May 20 '15 at 08:41

Burki

1,188
19
28

Error in sql query syntax

1 Answers1