0

I have been through my 5.1.73 MySQL manual and I just can't find the syntax error that MySQL is giving me when I try to POST/GET something:

mysqli_query($connect,'INSERT INTO serial (name, company, algo, country, notes) VALUES ('.$_GET['name'].','.$_GET['company'].','.$_GET['algo'].','.$_GET['country'].','.$_GET['notes'].')');

MySQL Error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'FCINGZ000***,Unknown,Thanks)' at line 1

Panda
  • 6,955
  • 6
  • 40
  • 55
Kirsty
  • 1
  • 1
    Please post the error message and search for SQL Injection. You're probably missing quite a few single-quotes (`'`) around your string values. – ccKep Apr 06 '16 at 23:02
  • @ccKep You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'FCINGZ000***,Unknown,Thanks)' at line 1 – Kirsty Apr 06 '16 at 23:03
  • 2
    Using a prepared statement will fix this (you are missing quotes around the string values) it will also fix the huge SQL Injection vulnerability you have, See [How can I prevent SQL-injection in PHP?](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) – Alex K. Apr 06 '16 at 23:06
  • As an aside, be aware that serial is considered a keyword in MySQL- though it's not reserved as such. – Strawberry Apr 06 '16 at 23:10
  • And see prepared statements – Strawberry Apr 06 '16 at 23:10

1 Answers1

0

You should assign the $_GET values to a variable to prevent syntax errors. Also, prevent MySQL Injection using mysqli_real_escape_string().

$name = mysqli_real_escape_string($connect, $_GET['name']);
$company = mysqli_real_escape_string($connect, $_GET['company']);
$algo = mysqli_real_escape_string($connect, $_GET['algo']);
$country = mysqli_real_escape_string($connect, $_GET['country']);
$notes = mysqli_real_escape_string($connect, $_GET['notes']);

mysqli_query($connect, "INSERT INTO serial (name, company, algo, country, notes) VALUES ('$name', '$company', '$algo', '$country', '$notes')");
Panda
  • 6,955
  • 6
  • 40
  • 55