PHP, MYSQL Creating a blog comment system

Question

I am currently working on developing a blogging system. For the most part I have the blog done, just creating the scripts to allow users to post comments to each blog. My PHP select code is getting an error along the lines of

check the manual that corresponds to your MySQL server version for the right syntax to use near 'DESC WHERE blogID = 6' at line 1.

The full code of my SQL statement is:

SELECT commentID, blogID FROM blog_comments   
ORDER BY commentID LIMIT 1 DESC WHERE blogID = '.$row['postID'];`

I am aware that this current statement is susceptible to SQL Injections, and have tried using tokens to ensure I am protected from that.

the $row['postiD'] is from a previous SQL statement that was ran to display the actual blog post. This is intended to go on the main page, where I don't need to display the actual comment text, but rather just the number of comments that are on that particular blog. I can post the full code if needed.

Okay, I updated my SQL statement and fixed that issue. However, the page is not displaying the commentID number, and $e is not getting executed, nor do I get any errors in my apache2 log.

$query = "SELECT commentID, blogID FROM blog_comments WHERE blogID ':postid' ORDER BY commentID DESC LIMIT 1";
$query_params = array(':postid' => $row['postID']);
try {
    $stmt = $db->prepare($query);
    $result = $stmt->execute($query_params);
}
catch(PDOException $e)
{
    // dont echo $e on production site
    die($e->getMessage());
}
$rows = $stmt->fetchAll();
?>
<?php foreach($rows as $row): ?>
    <?php echo $row['commentID']; ?>
<?php endforeach; ?>
comments

'SELECT commentID, blogID FROM blog_comments ORDER BY commentID LIMIT 1 DESC WHERE blogID = '.$row['postID'];..query misses a quote correct it and check again for errors: '.$row['postID'].' — Tharif, Jul 21 '15 at 05:24
Your order seems off have you tried `'SELECT commentID, blogID FROM blog_comments WHERE blogID = '.$row['postID'].' ORDER BY commentID DESC LIMIT 1'; ` — m1xolyd1an, Jul 21 '15 at 05:25
SO works on a 1 question per post basis. If you have new question, create a new post, referencing back to this one. — Strawberry, Jul 21 '15 at 06:54

score 6 · Accepted Answer · edited Jul 21 '15 at 05:41

6

Move WHERE case just after select:

'SELECT commentID, blogID FROM blog_comments 
 WHERE blogID = '.$row['postID'].' ORDER BY commentID DESC LIMIT 1'

To prevent SQL-injections use PDO and prepared statements : (http://php.net/manual/en/pdo.prepared-statements.php).

edited Jul 21 '15 at 05:41

Luthando Ntsekwa

4,192
6
23
52

answered Jul 21 '15 at 05:25

Mantas

4,259
2
27
32

score 1 · Answer 2 · edited May 23 '17 at 12:13

1

You really need to learn how we create select ,order, where and limit statement in SQL

Your query would be

"SELECT `commentID`, `blogID` FROM `blog_comments`  WHERE `blogID` = '".$row['postID']."' ORDER BY `commentID` DESC LIMIT 1" ;

Read Tutorial

Also read How can I prevent SQL-injection

edited May 23 '17 at 12:13

Community

1
1

answered Jul 21 '15 at 05:25

Saty

22,443
7
33
51

score 1 · Answer 3 · answered Jul 21 '15 at 05:25

1

You have written wrong query

'SELECT commentID, blogID FROM blog_comments WHERE blogID = '.$row['postID'].' ORDER BY commentID DESC LIMIT 1';

answered Jul 21 '15 at 05:25

Prashant Srivastav

1,723
17
28

score 1 · Answer 4 · answered Jul 21 '15 at 05:32

1

Your query elements sequence seems wrong , Please follow below query sequence :

'SELECT commentID, blogID FROM blog_comments WHERE blogID = '.$row['postID'].' ORDER BY commentID DESC LIMIT 1';

Require to set ORDER BY & LIMIT after WHERE clause.

answered Jul 21 '15 at 05:32

Helping Hands

5,292
9
60
127

score -1 · Answer 5 · edited Jul 21 '15 at 06:00

-1

SELECT `commentID`, `blogID` FROM `blog_comments` WHERE blogID = $row['postID'] order by `commentID` DESC limit 1

edited Jul 21 '15 at 06:00

Saty

22,443
7
33
51

answered Jul 21 '15 at 06:00

Ram

117
6

PHP, MYSQL Creating a blog comment system

5 Answers5