I using PHP and MYSQL
i try catch fail to catch mysql syntax error, sql like below
SELECT * FROM lsht_admin WHERE AIC = '12345'' AND APAS ='abc' AND RST = 1
I purposely enter 12345'
, with a single apostrophe at the back. My code as below
try{
$sql = "SELECT * FROM lsht_admin WHERE AIC = '12345'' AND APAS = 'abc' AND RST = 1";
$run = mysql_query($sql);
if( $run === false ){
throw new Exception("404|$errMsg|$syRDT");
}else{
//continue
}
}catch(Exception $e){
//redirect to error page
}
It not able to catch the error and goto error page, it and just show me the error below
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '','2019-01-17 18:17:20')' at line 1
SOS:
1) How to catch the syntax error
2) Or any better way to write it
Thanks
Full Code Below
<?php
session_start();
include "../inc/ondb.php";
include "../inc/func.php";
include "../inc/datetime.php";
//foreach ($_POST as $K => $S) { echo "<br/>$K : $S"; }
$btn = ( (isset($_POST["BTN"])&&($_POST!=""))?$_POST["BTN"]:"");
$btn = ($btn==""?$_GET["BTN"]:$btn);
$goto="Location: ../index.php?err=0";
switch ($btn){
case "index_Submit":
try{
$AIC = $_POST["AIC"]; $APAS = $_POST["APAS"];
$sql = "SELECT * FROM lsht_admin WHERE AIC = '$AIC' AND APAS = '$APAS' AND RST = 1"; //echo $sql;
$run = mysql_query($sql);
if( $run === false ){
$errMsg = "身份证/密码可能存在乱码,无法进入系统!";
$HID = logHis("4018","$errMsg",$_POST["AIC"],$syRDT);
throw new Exception("4018.$HID|$errMsg|$syRDT");
echo "asdfadsf";
}else{
$HID = logHis("1001",$_POST["AIC"]."成功进入系统",$_POST["AIC"],$syRDT);
$rs = mysql_query($sql)or die(mysql_error());
while($row = mysql_fetch_assoc($run)){
$_SESSION["ARR"] = $row;
mysql_query("update lsht_admin set RDT = '$syRDT' WHERE AID = $row[AID]")or die(mysql_error());
switch($row["ATYP"]){
case 0: $goto="Location: ../blank.php"; break;
case 1:
$sql = "SELECT PAIC FROM lsht_admin WHERE ATYP=2 GROUP BY PAIC";
$rw = mysql_query($sql);
$nr = mysql_num_rows($rw);
if($nr==1){
$goto="Location: ../admin.php";
}else{
$goto="Location: ../index.php?err=1";
}
break;
case 2: $goto="Location: ../president.php"; break;
default : $goto="Location: ../blank.php"; break;
}
}
}
}catch(Exception $e){
$goto="Location: ../index.php?err=0";
}
break;
}
include "../inc/offdb.php";
header($goto);
?>
function logHis($errCod,$errMsg,$AIC,$syRDT){
$HID = getNID("lsht_history","HID");
$sql = "INSERT INTO lsht_history (HID,HACT,HDESC,AIC,RDT) VALUES ($HID,'$HID.$errCod','$errMsg',$AIC,'$syRDT')";
mysql_query($sql) or die(mysql_error());
return $HID;
}