Can't upload file, error

Question

Hey guys so here is my table:

    CREATE TABLE mytable (
ID int AUTO_INCREMENT,
Name varchar(255) NOT NULL,
PRIMARY KEY (ID));

There is my code:

<?php
$servername = "localhost";
$username = "root";
$password = "";
$dbname = "mydb";

try {
$conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);
// set the PDO error mode to exception
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

// begin the transaction
$conn->beginTransaction();
// our SQL statements
$size = "";
$dir = "test";
if ($handle = opendir($dir)) {
while (false !== ($file = readdir($handle))) {
        if($file == '.' || $file == '..') continue;

    $myFile = "$dir/$file";
    $fh = fopen($myFile, 'r');

    $size = filesize($myFile);
    if ($size > 0) {
    $content = fread($fh, $size);

    $title = $file; 
    echo $title."</br>";
    }
$models = explode("\r",$content);
$conn->exec("INSERT INTO `mytable` (`Name`) 
VALUES".$models); 

    fclose($fh);
}
closedir($handle);
}

// commit the transaction
$conn->commit();
echo "Succsess";
}
catch(PDOException $e)
{
// roll back the transaction if something failed
$conn->rollback();
echo "Error: " . $e->getMessage();
}

$conn = null;
?>

Here is how my text file looks:

4745G
VN7-572
E5-511G
VN7-571....

And i keep getting this error: SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax;

Anyone know what i did wrong and how to fix it?

`mytable` should be back ticked, not quoted. You really shouldn't use `Text` as a column name as it is a MySQL keyword and may cause you issues down the road. — Jay Blanchard, Jul 10 '17 at 17:54
You should only back tick table and column names, not values. You have back ticked `Name` when it should be quoted. — Jay Blanchard, Jul 11 '17 at 11:36
It doesnt work if i quote it anyway, and i dont understand you "Name" is my column name so i can back tick it — David, Jul 11 '17 at 12:34
Have you read or followed any file upload tutorials? My bad, Name should be back ticked. I just hadn't had enough coffee and misread. — Jay Blanchard, Jul 11 '17 at 12:36
Yes i have seen few, how do you think i made this shit code lol — David, Jul 11 '17 at 12:40
There is no tutorial I know of which would tell you to upload files (there is no upload here, you would be reading a file already on the server with this code) in this method. — Jay Blanchard, Jul 11 '17 at 12:41
Well this code works with another table and values, but i need this to make it work too — David, Jul 11 '17 at 12:44
In the text file: ('4745G'), ('VN7-572'), ('E5-511G'), ('VN7-571') — David, Jul 20 '17 at 11:50
[Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)***. Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! — Jay Blanchard, Jul 20 '17 at 11:52
with ('') its working, but i want to work it without it and i get error — David, Jul 20 '17 at 11:53
You have to use quotes around the inserted content in the query if you're not preparing the query and you have to get the parentheses correct: $conn->exec("INSERT INTO `mytable` (`Name`) VALUES ('".$models."')"); — Jay Blanchard, Jul 20 '17 at 12:21

Can't upload file, error

0 Answers0