PHP mysqli insert return error invalid request

Question

I've been having a bit of trouble with my PHP code. I'm trying to insert a new row in table gebruikers. I'm using a JSON API to post the data from my C# Android app to the server. running the code returns an invalid request error.

PHP:

function registerUser($api_data)
{

// connection
$servername = "xxx";
$username = "xxx";
$password = "xxx";
$database = "test";

$mysqli = new mysqli($servername, $username, $password, $database);

//check connection
if(mysqli_connect_errno()) 
{
    API_Response(true, 'connection error');
}

$register_data = json_decode($api_data);

$leerlingnummer = intval($register_data->leerlingnummer); //passed as string, int in database
$wachtwoord = $register_data->wachtwoord;   //string
$email = $register_data->email; //string

$result = $mysqli->query("INSERT INTO `gebruikers` (`Leerlingnummer`, `Wachtwoord`, `Email`) VALUES ({$leerlingnummer}, {$wachtwoord}, {$email})");

if ($result == false)
{
    API_Response(true, "{$mysqli->error}");
}

else
{       
    API_Response(false, 'SUCCESS');
}

$mysqli->close();
}

database is looking as follows: database layout

`$wachtwoord` and `$email` are strings, so they need to be quoted -> `..., '{$wachtwoord}', '{$email}')");` — Sean, Dec 04 '16 at 15:55
@Sean in fact they rather have to be parametrized. But if it's a syntax error in the query, he should supposedly get the error message. But he gets something different. — Your Common Sense, Dec 04 '16 at 15:57
Time to also read [How can I prevent SQL injection in PHP?](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — Sean, Dec 04 '16 at 15:58
this isn't just about quotes but a variable scope also, and who knows how you're using that `registerUser()` function. — Funk Forty Niner, Dec 04 '16 at 16:04
@your-common-sense the only thing that returns an error is the mysqli->error. PHP logs don't show any errors. Is there perhaps a more detailed mysqli error? — Davey Vermeulen, Dec 04 '16 at 17:25

score 0 · Answer 1 · answered Dec 04 '16 at 18:21

I've never felt this stupid before, but the error came from the fact that I was still referencing to an older .php file. I was so focussed on the PHP script that I didn't notice this error in my app before.

the quotes advised by Sean and fuso were needed later on though so thanks for that.

Problem solved, sorry for wasting some of your time :/

score -1 · Answer 2 · answered Dec 04 '16 at 15:59

-1

You should quote your data in the insert query.

... VALUES ('{$email}','{$other}')

answered Dec 04 '16 at 15:59

Matteo Fusillo

14
2

They should, but that isn't the only problem. – Funk Forty Niner Dec 04 '16 at 16:07

PHP mysqli insert return error invalid request

2 Answers2