Error in SQL syntax, generated by a php foreach

Question

I don t know why the second round of foreach give me this error:

"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '8,1)' at line 2"

$Ntavolo = Array ( [0] => 46 [idordine] => 46 ) ;
$queryordine= "SELECT `idordine` FROM `ordine` WHERE `tavolo`=$Ntavolo ORDER BY `ordine`.`dataora` DESC LIMIT 1";
$result = mysqli_query($con,$queryordine);
$array=Array ( [0] => Array ( [id] => 1 [qta] => 1 ) [1] => Array ( [id] => 8 [qta] => 1 ) ) ;  
foreach($array as $value){
    $row  = mysqli_fetch_array($result);
        print_r($row);
        print_r($array);
    $idordine=$row['idordine'];
    $queryinsert="INSERT INTO `dettaglio` (`iddettaglio`, `idordine`, `idprodotto`, `quantita`)
    VALUES (NULL, ".$idordine.",".$value['id'].",".$value['qta'].");";
    mysqli_query($con,$queryinsert)or die(mysqli_error($con));
    echo($queryinsert);
};?>

You are wide open for SQL injection. Since you're using mysqli, take advantage of [prepared statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) and [bind_param](http://php.net/manual/en/mysqli-stmt.bind-param.php). And you won't have to worry about any pesky quoting issues. — aynber, Jun 14 '17 at 17:59
You really need to look at the full statement being executed. (contents of `$queryinsert` variable) MySQL syntax errors generally expect you to compare with the original query. If you still can't figure it out, paste the full query as it is being sent to MySQL for execution here and we then might have an easier time deciphering the error. — ebyrob, Jun 14 '17 at 18:09

score 0 · Answer 1 · answered Jun 14 '17 at 18:13

0

 $queryinsert="INSERT INTO `dettaglio` (`iddettaglio`, `idordine`, `idprodotto`, `quantita`)
VALUES (NULL, ".$idordine.",".$value['id'].",".$value['qta'].");";

here only one termination ; should be given you have inserted two termination

 $queryinsert="INSERT INTO `dettaglio` (`iddettaglio`, `idordine`, `idprodotto`, `quantita`)
    VALUES (NULL, ".$idordine.",".$value['id'].",".$value['qta'].")";

answered Jun 14 '17 at 18:13

Prashant

90
1
12

One of the `;` is going to MySQL in a text string. The other one is in PHP code. Of course, if multi-query isn't set the MySQL `;` would fail, but that isn't apparent given the error message from MySQL. – ebyrob Jun 14 '17 at 18:14
yes but with one termination point also it will run. the error is given because of all the commas he has used – Prashant Jun 14 '17 at 18:25
`$hello = "A word I like; hello.";` is perfectly valid PHP no? Only 1 terminator there no? – ebyrob Jun 14 '17 at 18:34

score 0 · Answer 2 · answered Jun 14 '17 at 18:35

the error was in $row, in the second query $row don't take the value... Thanks all!!!

$row  = mysqli_fetch_array($result);
$idordine=$row['idordine'];
foreach($array as $value){
$queryinsert="INSERT INTO `dettaglio` (`iddettaglio`,`idordine`,`idprodotto`,`quantita`)VALUES (NULL,".$idordine.",".$value['id'].",".$value['qta'].")";
mysqli_query($con,$queryinsert)or die(mysqli_error($con));};

Error in SQL syntax, generated by a php foreach

2 Answers2