We hope you enjoy your visit.

You're currently viewing our forum as a guest. This means you are limited to certain areas of the board and there are some features you can't use. If you join our community, you'll be able to access member-only sections, and use many member-only features such as customizing your profile, sending personal messages, and voting in polls. Registration is simple, fast, and completely free.


Join our community!


If you're already a member please log in to your account to access all of our features:

Username:   Password:
Add Reply
Adding a record; PHP SQL ...
Topic Started: May 10 2005, 12:41 AM (511 Views)
James May 10 2005, 12:41 AM Post #1
Live to Dream
[ * * * * * * * ]
 $sql = "insert into userstable(user, pass, email, location, homepage) values ( 'check_injection($username)' , 'check_injection($pass)' , 'check_injection($email)' , 'check_injection($location)' , 'check_injection($homepage)' )";

I have no idea what's going wrong, but up until that point everything seems okay in the file. the check_injection just outs to a function that does a stripslash and/or real_escape_string... but whatever I try, I can't get the data into the table. Something really simple i'm missing?
Offline Profile Quote Post Goto Top
 
Das May 10 2005, 12:48 AM Post #2
Member Avatar
Smells of rich mahogany
[ * * * * * * * ]
 I am not an expert, but I have made the mistake many times myself, did you go over it, and make sure all the corect letters were capitalized and/or lowercase. Sql seems to be very strict about proper casing.

If that dosn't work try it without check_injection and the ' marks aren't nessasry to the best of my knowladge.
Offline Profile Quote Post Goto Top
 
Sani May 10 2005, 12:53 AM Post #3
Member Avatar
Member
[ * * * * * ]
 Try this..
Code:
 
$sql = "insert into userstable(user, pass, email, location, homepage) values ( '".check_injection($username)."' , '".check_injection($pass)."' , '".check_injection($email)."' , '".check_injection($location)."' , '".check_injection($homepage)."'  )";


:)
Offline Profile Quote Post Goto Top
 
James May 10 2005, 12:58 AM Post #4
Live to Dream
[ * * * * * * * ]
 Will do. But i just tried inserting:

$sql = "insert into userstable values ( \"NULL\" , \"test\" , \"test\" , \"test@test.com\" , \"none\" , \"none\" )";

...just some direct values. And it still didn't add...
Offline Profile Quote Post Goto Top
 
James May 10 2005, 01:01 AM Post #5
Live to Dream
[ * * * * * * * ]
Sani
May 10, 2005 05:53 AM
Try this..
Code:
 
$sql = "insert into userstable(user, pass, email, location, homepage) values ( '".check_injection($username)."' , '".check_injection($pass)."' , '".check_injection($email)."' , '".check_injection($location)."' , '".check_injection($homepage)."'  )";


:)

Nope...still no show in my userstable.

Here's the full PHP file:

Code:
 

<?php

if($email != $email2){
die("The e-mail addresses did not match.");
}

if($pass != $pass2){
die("The passwords did not match.");
}

$email_pattern = '/^[^@s]+@([-a-z0-9]+.)+[a-z]{2,}$/i';
if (!preg_match($email_pattern, $email)) {  
die("The e-mail address supplied was not in the correct format.");
}

function check_injection($value){
  // Stripslashes
  if (get_magic_quotes_gpc()) {
      $value = stripslashes($value);
  }
  // Quote if not integer
  if (!is_numeric($value)) {
      $value = "'" . mysql_real_escape_string($value) . "'";
  }
  return $value;
}

$db=mysql_connect("localhost", "USER", "PASS") or die("Could not connect to localhost.");
mysql_select_db("DATABASENAME", $db) or die("Could not find the database.");

$sql = "insert into userstable(user, pass, email, location, homepage) values ( '".check_injection($username)."' , '".check_injection($pass)."' , '".check_injection($email)."' , '".check_injection($location)."' , '".check_injection($homepage)."'  )";

?>

Offline Profile Quote Post Goto Top
 
Sani May 10 2005, 01:06 AM Post #6
Member Avatar
Member
[ * * * * * ]
 Haha, silly me.. :P

Code:
 

$sql = mysql_query("insert into userstable(user, pass, email, location, homepage) values ( '".check_injection($username)."' , '".check_injection($pass)."' , '".check_injection($email)."' , '".check_injection($location)."' , '".check_injection($homepage)."'  )") or die(mysql_error());



You (and me and Das) forgot the mysql_query command.. :D
Offline Profile Quote Post Goto Top
 
James May 10 2005, 01:15 AM Post #7
Live to Dream
[ * * * * * * * ]
 I'll kick myself for that one in the morning!

Quote:
 

You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'test'' , ''test'' , ''create@create.com'' , ''test'' , ''test''


:\
Offline Profile Quote Post Goto Top
 
Das May 10 2005, 01:15 AM Post #8
Member Avatar
Smells of rich mahogany
[ * * * * * * * ]
Sani
May 9, 2005 10:06 PM
You (and me and Das) forgot the mysql_query command.. :D

Da*nit the second time :lol:
Offline Profile Quote Post Goto Top
 
Sani May 10 2005, 01:25 AM Post #9
Member Avatar
Member
[ * * * * * ]
 I could be wrong, but..
Try changing
Code:
 
     $value = "'" . mysql_real_escape_string($value) . "'";


to
Code:
 
     $value = "" . mysql_real_escape_string($value) . "";
Offline Profile Quote Post Goto Top
 
James May 10 2005, 09:41 AM Post #10
Live to Dream
[ * * * * * * * ]
 Yeahhhhhhhhhhhh!!!

Go you :D
Offline Profile Quote Post Goto Top
 
Rory May 10 2005, 11:40 AM Post #11
i;m a mess
[ * * * * * * * ]
 and just think, you could have saved yourself all this hassle by doing the escaping before the query.

That way, it looks nicer :)
Offline Profile Quote Post Goto Top
 
Seth May 10 2005, 01:23 PM Post #12
Member Avatar
I has a pony
[ * * * * * * * * * ]
 :D what Roree said.

Better to pass values that have already been escaped, rather than escaping inline.
Offline Profile Quote Post Goto Top
 
James May 10 2005, 05:08 PM Post #13
Live to Dream
[ * * * * * * * ]
 eehhh?

Like..create a clean array of values and drop them in? Me don't understand why that's better?
Offline Profile Quote Post Goto Top
 
Rory May 10 2005, 05:24 PM Post #14
i;m a mess
[ * * * * * * * ]
 because you wouldn't have all this:

"" . blah . ""

you would just have

values('$var1','$var2')

would be much much easier to read and find problems with :)
Offline Profile Quote Post Goto Top
 
James May 10 2005, 05:29 PM Post #15
Live to Dream
[ * * * * * * * ]
 Ohhh. To be honest, if there was a massive gorilla in the middle of my PHP script i still wouldn't be able to find it.

:D But thanks, i'll take note!
Offline Profile Quote Post Goto Top
 
1 user reading this topic (1 Guest and 0 Anonymous)
« Previous Topic · Technology Chat · Next Topic »
Add Reply