PHP/MySQL

[Hemmers]

So, trying to teach myself HTML, PHP and MySQL all at the same time

I've got a form, which seems to behave itself and sends data to PHP, which should then write a new row in MySQL.

Code: Select all

<?php
INCLUDE 'conn.php';

$compfore = $_REQUEST["compfore"];
$compsur = $_REQUEST["compsur"];
$sex = $_REQUEST["sex"];
$nation = $_REQUEST["nation"];

$query = "INSERT INTO competitor (forename, surname, sex, nationality)
  VALUES ($compfore, $compsur, $sex, $nation)";

$result = mysql_query($query, $conn) or die(mysql_error());

?>

conn.php:

Code: Select all

<?php
$server = "localhost";
$user = "user";
$pwd = "pwd";
$dbn = "db";

$conn = mysql_connect($server, $user, $pwd) or die(mysql_error());
mysql_select_db($dbn);
?>

I'm getting errors on line 2 (You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ' )' at line 2), which is just confusing because there is no ')' on line 2
I also managed to fix that and get an error down the bottom before I broke the top again

Is there something dreadfully wrong with my syntax? Can't work it out, as is abundantly obvious, I'm a total newbie, so it's probably all wrong...

Thanks!

[Xanthir]

Print out the $query string and show it?

Also, you need to learn this early - NEVER EVER put any data that came anywhere *near* a user directly into a sql string. ALWAYS escape it first with mysql_real_escape_string(). (Don't escape values too early, or you'll run into trouble. Escape them right at the moment you splice them into a string.)

Yes, that's a *completely* retarded and long function name. Alias it to something short so it won't kill your fingers every time.

[Hemmers]

Fixed it eventually, missed a few single quotes and there was actually a problem in the HTML form as well.

Thanks for the advice on escaping. I'd come across it but was deliberately ignoring it initially as I was just trying to get data from a form to a table first - I'm that new at this! Will be sure not to escape values too early though.

[Steax]

Better option - use PHP prepared statements through PDO. Pretty much regarded as best practice nowadays.

Good luck on your conquest!

[ocb]

Better option - use PHP prepared statements through PDO. Pretty much regarded as best practice nowadays.

this PDO is getting popular. I might try it

http://www.clothes4u.com.au/

[Kithplana]

Better option - use PHP prepared statements through PDO. Pretty much regarded as best practice nowadays.

this PDO is getting popular. I might try it

You should. It's awesome and harder to mess up than escaping.