query is not executing

Question

Can someone help me to fix this query? I dont know what error i have made. Please help me out..

insert into docs values('"$_POST['inputString']"','"$_POST['inputStringa']"','"$_POST['inputStringa1']"','"$_POST['inputStringa2']"','"$_POST['inputStringa3']"','"$_POST['inputStringa4']"')" ;

Please show any errors you get and the actual, generated SQL query. And your query is vulnerable to [SQL injection](http://stackoverflow.com/questions/4749588/protect-against-sql-injection) — Pekka, Jan 28 '11 at 09:54
maybe it's time to accept an answer! otherwise you won't get much help for your next question — Christophe, Apr 05 '11 at 10:24

score 4 · Answer 1 · answered Jan 28 '11 at 09:56

Your quotes are not right. Single quotes and double quotes are getting mixed up. Do it like this:

mysql_query("insert into docs
values('{$_POST['inputString']}','{$_POST['inputStringa']}',
'{$_POST['inputStringa1']}','{$_POST['inputStringa2']}',
'{$_POST['inputStringa3']}','{$_POST['inputStringa4']}')") ;

Also, remember to pass through all the POST variables through mysql_real_escape_string like this:

$_POST['inputString'] = mysql_real_escape_string($_POST['inputString']);

Do this BEFORE running the query.

score 3 · Answer 2 · answered Jan 28 '11 at 09:55

3

Read the PHP manual entry on strings and learn the basic syntax, you'll discover why this code doesn't work:

http://php.net/manual/en/language.types.string.php

answered Jan 28 '11 at 09:55

Dan Grossman

51,866
10
112
101

score 2 · Accepted Answer · answered Jan 28 '11 at 10:05

you are missing "." in the query

$sql = "INSERT INTO docs VALUES('".$_POST['inputString']."','".$_POST['inputStringa']."','".$_POST['inputStringa1']."','".$_POST['inputStringa2']."','".$_POST['inputStringa3']."','".$_POST['inputStringa4']."')";

or use

for remove vulnerablities

mysql_query("insert into docs values ( ' { $_POST['inputString'] }' ,'{$_POST['inputStringa']}',' {$_POST['inputStringa1']}','{$_POST['inputStringa2']}',
'{$_POST['inputStringa3']}','{$_POST['inputStringa4']}')") ;

score 1 · Answer 4 · answered Jan 28 '11 at 09:58

you use both single quote and double quotes, you cant do that. You need to concatenate the post values like so:

$sql = "INSERT INTO docs VALUES('".$_POST['inputString']."','".$_POST['inputStringa']."','".$_POST['inputStringa1']."','".$_POST['inputStringa2']."','".$_POST['inputStringa3']."','".$_POST['inputStringa4']."')";

mysql_query($sql);

query is not executing

4 Answers4