1

I have this piece of code

<?php


$con = mysql_connect("localhost","root","password");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}

mysql_select_db("tables", $con);
$sql="INSERT INTO customer (Name, Telephone, Email, Address, PostCode, Specialisation )
VALUES
($_POST['firstname'], $_POST['telephone'],$_POST['email'],         $_POST['address'],$_POST['postcode'],$_POST['special'])";

if (!mysql_query($sql,$con))
{
die('Error: ' . mysql_error());
} 
echo "Inserted into Worker database";

mysql_close($con);
?>

I keep getting this error- Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in.

I am not sure what else to do. Please help. Thanks

Ester
  • 143
  • 1
  • 3
  • 12
  • Can you please tell us which line causes this error? – Intrepidd Apr 03 '12 at 16:50
  • This line--($_POST['firstname'], $_POST['telephone'],$_POST['email'], $_POST['address'],$_POST['postcode'],$_POST['special'])"; – Ester Apr 03 '12 at 16:51
  • i Think first you should checkout what query you are executing by printing it. Is it the Query you wanted check it with phpmyadmin & let me know. – Sumant Apr 03 '12 at 16:55
  • 1
    i hope your username and pass are not actually root and password. i'm just looking at it now – encodes Apr 03 '12 at 16:55
  • $sql = "Insert into customer (Name, Telephone, Email, Address, PostCode, Specialisation) values (" .$_POST['firstname'] . "," . $_POST['telephone'] . ",". $_POST['email'] .",". $_POST['address'] .", ". $_POST['postcode'] ."," .$_POST['special'] .")";# – encodes Apr 03 '12 at 16:56
  • 1
    the above will work, but you need to quote the values also – encodes Apr 03 '12 at 16:56
  • It looks like some syntax error is there like string value should be within quots **""** – Sumant Apr 03 '12 at 16:57

2 Answers2

4

You have several issues.

First, string values you're inserting into the database need single quotes around them.

Second, array variables in strings need to be wrapped in {} (i.e. $string = "Something something {$_POST['variable']}..."; to help the PHP parser figure them out.

Third, this code (once working) is massively vulnerable to hacking via SQL injection. Consider using PDO and prepared statements (as the mysql_* functions are being deprecated), or at the very least run user input through mysql_real_escape_string().

$sql="INSERT INTO customer (Name, Telephone, Email, Address, PostCode, Specialisation) VALUES ('" . mysql_real_escape_string($_POST['firstname']) . "', '" . mysql_real_escape_string($_POST['telephone']) . "', '" . mysql_real_escape_string($_POST['email']) . "', '" . mysql_real_escape_string($_POST['address']) . "', '" . mysql_real_escape_string($_POST['postcode']) . "', '" . mysql_real_escape_string($_POST['special']) . "')";

Fourth, you really shouldn't use the database's root user to connect.

ceejayoz
  • 176,543
  • 40
  • 303
  • 368
1

Change your $sql variable to read on one line and to send the proper format to SQL:

$sql="INSERT INTO customer (Name, Telephone, Email, Address, PostCode, Specialisation ) VALUES ({$_POST['firstname']}, {$_POST['telephone']},{$_POST['email']}, {$_POST['address']},{$_POST['postcode']},{$_POST['special']})";

That should correct the PHP error of unexpected T_ENCAPSED_AND_WHITESPACE but you will need more corrections to fix the SQL Injection possibility.

Community
  • 1
  • 1
PenguinCoder
  • 4,335
  • 1
  • 26
  • 37