strange sql error

Question

i have the following code:

<!--ajouter une carte     -->
<?php
if($_POST["submit_dd"]){

    mysql_query("INSERT INTO data SET desc='".$_POST["carte_nom"]."' ") or die(mysql_error());



 }
?>

<b>Ajouter une carte:</b><br>
<form method="post">
<table>
<tr><td>nom</td><td><textarea name="carte_nom"/></textarea></td></tr>
<tr><td></td><td><input type="submit" name="submit_dd" value="Ajouter"/></td></tr>
</table>
</form>

i get an error from this very simple query:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'desc='dsfgsdfds'' at line 1

the database is very simple: id(primary, auto increment), desc(text)

regards

hmmm... looks like you could have a sql injection problem there ;) — Jakub, Oct 14 '11 at 04:20
Try using prepared statements and placeholders. http://dev.mysql.com/doc/refman/5.0/en/sql-syntax-prepared-statements.html — Cliff, Oct 14 '11 at 04:23

score 4 · Accepted Answer · answered Oct 14 '11 at 04:19

4

I might be wrong, but you are probably getting an error because desc is a sql keyword. try wrapping it in back ticks `desc`

answered Oct 14 '11 at 04:19

Brian Glaz

15,468
4
37
55

Ramesh Soni · Answer 2 · 2011-10-17T05:18:39.373

1

desc is a reserve keyword. Use "desc" instead

edited Oct 17 '11 at 05:18

answered Oct 14 '11 at 04:20

Ramesh Soni

15,867
28
93
113

score 0 · Answer 3 · answered Oct 14 '11 at 04:19

0

mysql_query("INSERT INTO data (desc) VALUES('".$_POST["carte_nom"].")' ")

answered Oct 14 '11 at 04:19

Cliff

1,621
1
13
22

yeah, I was just editing my answer to suggest placeholders and prepared statements, but I will just make a comment. – Cliff Oct 14 '11 at 04:22

score 0 · Answer 4 · edited May 23 '17 at 12:27

Check the list of reserved keywords. "DESC" is one of them.

The following is valid in MySQL:

INSERT INTO data SET `desc` = 'post data';

You should rethink your script though. Having fields named the same as reserved keywords is a bad sign. As is the lack of sanitation before using the $_POST data.

Here's why desc is an ugly fieldname:

SELECT id, desc
FROM data
ORDER BY id desc;  #this is valid sql, but likely isn't going to do what you expect

Which look very much like

SELECT id, desc
FROM data
ORDER BY id, desc;   #not valid sql

And the obligatory injection reading: How does the SQL injection from the "Bobby Tables" XKCD comic work?

strange sql error

4 Answers4