PFMaBiSmAd

Column names, table names, and keywords (function names, data types...) are not enclosed in single-quotes as that would make them string data.

That's no error. It is raw php code. Your opening php tag is not one.

In addition to needing to access the image as submit buttons as $_POST['NewContent_x'] and $_POST['EditContent_x'], your page has 10 HTML validation errors, some of which might render it invalid in some browsers - http://validator.w3.org/check?uri=http%3A%2F%2Fwww.des-otoole.co.uk%2Fcms%2Fadmin%2Fpages.php&charset=%28detect+automatically%29&doctype=Inline&group=0

http://www.php.net/manual/en/faq.html.php#faq.html.form-image

Additional to the above reply - Are you also sure that $image_name does not contain any / characters that when combined with userimages/trackimages/ produces a path that does not exist.

The actual error message and the code would help. There are at least a half-dozen different things that could go wrong with an upload script or with a directory path that could cause an error that would look like it is a path problem. Are you sure that relative to the main script that is running that the userimages/trackimages/ path exists with that spelling and capitalization (assuming you are on an operating system that is case sensitive)?

If you unconditionally use stripslashes(), that will prevent you from ever having an actual \ as part of the data on systems where magic_quotes_gpc are turned off (or under php6 where magic_quotes_gpc has finally been removed). I posted code using an if(){} statement for a reason.

If your data is escaped only ONCE, the \ do not appear in the database. You do need to use mysql_real_escape_string on all string data put into a query. If magic_quotes_gpc is ON, you must either turn it off or you must use stripslashes() on any external (get, post, cookie) data, then use mysql_real_escape_string on it. if(get_magic_quotes_gpc()){ $var = stripslashes($var); } $var = mysql_real_escape_string($var);

If your data is escaped properly, the escape characters \ DO NOT appear in the database. They are only present in the query string so that the special sql characters that are part of the data don't break the sql syntax.

If the line of code you posted is the entire code, then it is a mis-print in the book because that is invalid syntax.

Did you look at line 11 of connect.php to try and solve this?

If you read the actual error message, it tells you where the output is being started at that is preventing the session_start() from working. You must find and prevent whatever is being output before the session_start statement.

What is your exact error message because your problem might or might not be the same? The error message in the first post in the thread means that there is no mysql server running on the localhost computer or it is not listening on the default port number. Are you doing this on your localhost computer and your know that you have a mysql server installed, it is running, and it is listening on the default port number 3306?

The length of your password field in the table is probably too short to hold the complete md5 value.

The error you are listing for line 20 actually occurs on line 4 of what you posted, because there is an extra ) on the end of line 4. You also have a couple of smart/curly-quotes in the following (you must have copy pasted that from a word processor, rather than a programming editor) - or die(‘Error connecting to MySQL server.’);

That's because all three are just different methods of forming a string in php and they are all equivalent. What is the code and where is it that is displaying the mysql_error(), because it is highly likely that it is a different piece of code that is producing the error.

Then fix the code, don't turn the setting on that would cause $REQUEST_METHOD to work. The specific setting, because it opened a huge security hole (allows hackers to set session variables) was turned off by default over 7 years ago and has been completely removed in php6. If you are fixing the code, then fix it so that is uses the correct array variables.

Why on earth did you change the back-ticks you originally had around the table and column names into single-quotes? No one suggested to do that. You are probably not getting any error output from the or trigger_error(....) statement because what it does is dependent on the error_reporting/display_errors/log_errors settings. Either turn on full php error reporting/display errors (you should be developing and debugging php code on a system with error_reporting set to E_ALL and display_errors set to ON anyway to get php to help you) or use the or die(...) statement that bl00dshooter suggested as it will always give you output on an error whereas the or trigger_error() statement won't.

You could always look that up in the documentation to find out the answer yourself - http://dev.mysql.com/doc/mysqld-version-reference/en/mysqld-version-reference-reservedwords-5-0.html

Yes, the creation or input of data, manipulation or processing of that data, storage and retrieval of that data, and display or output of that data is WHAT computers, programming languages, and databases were created to do, even php and mysql. You define the steps that need to occur to accomplish the stated task (i.e. log in system, data entry form, form processing and storage in the database, admin page with menu/links/form to select data to view or output, database retrieval and display code...) You then iterate through each step, adding more and more details, such as the data needed (i.e. what data will be entered on the form, what fields will there be in the database), what the user interface will be in each step (i.e. what menus/links/form fields will be on the page), what error messages will be produced and where and how will they be displayed, what will the code do if there is a fatal database error... Once you have all the details sufficiently defined, you can then start designing, writing, and testing the code for each step.

It would really help if you posted the whole sql error message, but best guess is that $title contains a special sql character, like a single-quote, that is breaking the syntax of the query. You must escape all string data put into a query if it could contain any special sql characters. See this link - mysql_real_escape_string

There are two branches of the Windows binary files, VC6 and VC9. VC9 should be the correct one for IIS. There is a chance that the Microsoft Web Platform is doing the same (dumb) stuff that the php .msi installer does (perhaps it is using the .msi installer package internally.) If this is the case, you are expected to add/remove php language extensions by going through the control panel add/remove menu item for php, because it turns out they are storing settings in the Windows registry that override the php settings that you are attempting to alter.

You need to ORDER BY the original column. When you use an alias name that is the same as the column name, the alias value is used. I would pick a different alias name.

That error message (unfortunately) also occurs when the auxiliary libeay32.dll and ssleay32.dll files are not in a folder that is in the Windows PATH statement.

You can do it directly in the query - http://dev.mysql.com/doc/refman/5.0/en/date-and-time-functions.html#function_date-format No slow parsed, tokenized, interpreted php code is necessary.