-1

I am using mysqli_real_escape_string((int)$id)) to prevent from sql injection but the problem is I receive this kind of error Parse error: syntax error, unexpected ')'

   $get = "SELECT id, product_name, description, price, quantity FROM products WHERE id=".mysqli_real_escape_string((int)$id));
HelpMe
  • 165
  • 3
  • 14

2 Answers2

1

Just remove the last parenthesis.

Make it look like:

$get = "SELECT 
          id, product_name, description, price, quantity 
        FROM 
          products 
        WHERE 
          id = ".mysqli_real_escape_string((int)$id);
Ahsan
  • 1,084
  • 2
  • 15
  • 28
0

The last parenthesis is one too many, change:

mysqli_real_escape_string((int)$id))

To:

mysqli_real_escape_string((int)$id)

If you'll notice the error you got, it explains that the file couldn't even be parsed because the parser encountered a ) that it was not expecting, and it tells you the line too! Next time carefully read the error message and you'll get more info than you think :)

So to be clear change:

$get = "SELECT id, product_name, description, price, quantity FROM products WHERE id=".mysqli_real_escape_string((int)$id));

To:

$get = "SELECT id, product_name, description, price, quantity FROM products WHERE id=".mysqli_real_escape_string((int)$id);

Chris Trudeau
  • 1,427
  • 3
  • 16
  • 20