-2

I am trying out a reviewer, and I keep getting this error.

( ! ) Parse error: syntax error, unexpected '' (T_ENCAPSED_AND_WHITESPACE), expecting identifier (T_STRING) or variable (T_VARIABLE) or number (T_NUM_STRING) in D:\wamp\www\Final_Exam\roomreserved.php on line 18

and this is what's on line 18

mysqli_query($con, "insert into Reservation values ('$CN['CNO']', CURDATE(), '$RoomCode', '$NoR', '$RC['RoomDesc']')")
General Grievance
  • 4,555
  • 31
  • 31
  • 45
user9765437
  • 23
  • 2
    Wouldn't have this problem if you'd used [prepared statements](http://php.net/manual/en/mysqli.prepare.php) with [bound parameters](http://php.net/manual/en/mysqli-stmt.bind-param.php). – CD001 May 09 '18 at 14:32
  • 2
    I don't think this question is deserving of downvotes IMO, the OP is obviously learning as they say; `I have an exam tomorrow`, cut them some slack Jack's :) – Can O' Spam May 09 '18 at 14:34
  • @SamSwift웃 - I didn't d/v as the question meets the criteria; it states the problem and just about provides a minimal, complete, verifiable example ... but I'm 99% certain it'll be a duplicate is all. – CD001 May 09 '18 at 14:40
  • Using a good IDE/Editor with syntax highlighting would go a long way to solving issues like this one. – aynber May 09 '18 at 15:17

1 Answers1

4

The issue here is you are not escaping your PHP variables in your strings;

mysqli_query($con, "insert into Reservation values ('{$CN['CNO']}', CURDATE(), '$RoomCode', '$NoR', '{$RC['RoomDesc']}')");

What is happening is, your array's have single quotes and so does your query, so using the curly braces around the variables will "escape them"

Using the single quotes in both the arrays and the query causes it to think there are more strings than expected

You can do this other ways too, here is an example with curly braces around ALL variables and one where the variables are "concatenated" to the query string respectively;

mysqli_query($con, "insert into Reservation values ('{$CN['CNO']}', CURDATE(), '{$RoomCode}', '{$NoR}', '{$RC['RoomDesc']}')");
mysqli_query($con, "insert into Reservation values ('" . $CN['CNO'] . "', CURDATE(), '" . $RoomCode . "', '" . $NoR . "', '" . $RC['RoomDesc'] . "')");

One thing to also take into consideration - is the user of this malicious? Look into functions such as addslashes or mysqli_real_escape_string to help your battle against SQL injection - both of these are "acceptable", but not the best, look into prepared statements as these are the best option for SQL Injection Prevention (CD001 gives the best resources for this in the comments of your question)

Can O' Spam
  • 2,718
  • 4
  • 19
  • 45