0

screenshot

$sql = "INSERT INTO `waitinglist` (`reserver`, `roomNumber`, `hotelNumber`, `queueDepth`) 
        VALUES(".$this->db->escape($reserver).", ".$room.", ".$i.", ".$queueDepth+1.")";
$this->db->query($sql);

What did I do wrong?

tereško
  • 58,060
  • 25
  • 98
  • 150
Bintang Subuh
  • 1
  • _You mean appart from_ Your script is at risk of [SQL Injection Attack](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Have a look at what happened to [Little Bobby Tables](http://bobby-tables.com/) Even [if you are escaping inputs, its not safe!](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) Use [prepared parameterized statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) – RiggsFolly May 14 '17 at 15:13
  • Are all 4 columns numeric, or are some of them text columns – RiggsFolly May 14 '17 at 15:14

1 Answers1

0

Use better editor/IDE with error highlighting, this is easy to solve syntax error:

$sql = "INSERT INTO `waitinglist` (`reserver`, `roomNumber`, `hotelNumber`, `queueDepth`) 
        VALUES(".$this->db->escape($reserver).", ".$room.", ".$i.", ".($queueDepth+1).")";
shaggy
  • 1,708
  • 2
  • 15
  • 17