tommyda Posted November 4, 2008 Share Posted November 4, 2008 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 2 I am tying to modify the complete user system by biorust.com with a profile system. The script checks the database for a profile, If there is a profile for the specific user then the script should echo a link to the edit profile page, but if there is no profile, it should echo a link to the create profile page. Im thinking the problem I am having is that the if else statement I need for this function is conflicting with an if else statement beginning at the top and ending at the bottom of the code. If anyone could help me resolve this problem I would be happy to give + Rep. Thanks <?php session_start(); if($_SESSION['s_logged_n'] == 'true'){ include 'process.php'; ?> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Members Page</title> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <link href="style.css" rel="stylesheet" type="text/css"> </head> <body> <div id="wrapper"> <div id="head">The member page</div> <br> <div id="container"> <? include 'menus.php' ?> </div> <div id="spacer"> </div> <div id="memmain"> <?php switch($_GET['change']){ case 'password': echo '<form action="'.$_SERVER['PHP_SELF'].'" method="post"> <p>Current password:<br> <input name="current" type="password" class="textBox"></p> <p>New password:<br> <input name="new" type="password" class="textBox"></p> <p>Confirm new password:<br> <input name="confirm" type="password" class="textBox"></p> <p><input type="submit" value="Change Password" name="changepassword"></p> </form> '; break; case 'email': echo '<p> WARNING! - By changing your email address you will have to re-validate. Make sure you email address is 100% correct.</p> <form action="'.$_SERVER['PHP_SELF'].'" method="post"> <p>Current email:<br> <input name="current" type="text" class="textBox"></p> <p>New email:<br> <input name="new" type="text" class="textBox"></p> <p>Confirm new email:<br> <input name="confirm" type="text" class="textBox"></p> <p><input type="submit" value="Change Email" name="changeemail"></p> </form> '; break; case 'account': echo '<p> WARNING - By closing your account, you will not be able to login again under this account. Press the button below to confirm you wish to close your account</p> <form action="'.$_SERVER['PHP_SELF'].'" method="post"> <p><input type="submit" value="Close Account" name="closeaccount"></p> </form> '; break; default:}; echo '<p>Welcome to the super secret members only control panel!</p>'; $result = mysql_query("SELECT * FROM Users WHERE username = $_GET[username]") or die(mysql_error()); // get the first (and hopefully only) entry from the result $row = mysql_fetch_array( $result ); if(isset($row['profile'])) echo'Edit Profile';// If there is no profile display edit profile link else echo'Please Create a Profile';// If there is no profile display create profile link ?> </div> </body> </html> <?php } else { /*echo $_SESSION['s_logged_n'].'b'; echo $_SESSION['s_username'].'c'; echo $_SESSION['s_name'].'d';*/ header("Location: login.php"); } ?> Quote Link to comment Share on other sites More sharing options...
genericnumber1 Posted November 4, 2008 Share Posted November 4, 2008 you forgot the closing bracket on your switch() statement. Quote Link to comment Share on other sites More sharing options...
tommyda Posted November 4, 2008 Author Share Posted November 4, 2008 you forgot the closing bracket on your switch() statement. Thanks Now the error is: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 2 Quote Link to comment Share on other sites More sharing options...
genericnumber1 Posted November 4, 2008 Share Posted November 4, 2008 You need quotes around the username in your query. Quote Link to comment Share on other sites More sharing options...
tommyda Posted November 4, 2008 Author Share Posted November 4, 2008 You need quotes around the username in your query. When I add quotes I get this: Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in /home/website/public_html/account-systems/***/member.php on line 74 Quote Link to comment Share on other sites More sharing options...
genericnumber1 Posted November 4, 2008 Share Posted November 4, 2008 post your query? Quote Link to comment Share on other sites More sharing options...
tommyda Posted November 4, 2008 Author Share Posted November 4, 2008 $result = mysql_query("SELECT * FROM Users WHERE username = $_GET['username']") or die(mysql_error()); Quote Link to comment Share on other sites More sharing options...
trq Posted November 4, 2008 Share Posted November 4, 2008 $result = mysql_query("SELECT * FROM Users WHERE username = '{$_GET['username']}'") or die(mysql_error()); Quote Link to comment Share on other sites More sharing options...
genericnumber1 Posted November 4, 2008 Share Posted November 4, 2008 As thorpe pointed out, when including arrays in a string it is good (and often necessary) to include braces around the array. Quote Link to comment Share on other sites More sharing options...
tommyda Posted November 4, 2008 Author Share Posted November 4, 2008 Perfect, thank you Quote Link to comment Share on other sites More sharing options...
laffin Posted November 4, 2008 Share Posted November 4, 2008 it wasnt the braces that solved the error. it was the single quotes around the variable. mysql must know that what you are trying to find isnt another field, so ya must enclose the text within quotes. WHERE username = lisa will look for a field name lisa WHERE username = 'lisa' will look for lisa in the username column the braces help seperating yer variables from the string. and ya shud pass any strings through mysql_real_escape_string to avoid some nasty mysql injections. good luck Quote Link to comment Share on other sites More sharing options...
genericnumber1 Posted November 4, 2008 Share Posted November 4, 2008 it wasnt the braces that solved the error. it was the single quotes around the variable. mysql must know that what you are trying to find isnt another field, so ya must enclose the text within quotes. WHERE username = lisa will look for a field name lisa WHERE username = 'lisa' will look for lisa in the username column the braces help seperating yer variables from the string. and ya shud pass any strings through mysql_real_escape_string to avoid some nasty mysql injections. good luck the single quotes fixed the mysql problem, but the braces were also required. Try <?php $str = "test $_GET['var'] test"; ?> I can assure you it will not be parsed properly. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.