You have an error in your SQL syntax;

[dhillon555]

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\"tom\"' at line 1

 

 

I am am getting the following error I am using the following code can anybody help me  ???

 

 

$username = mysql_escape_string($_SESSION['myusername']);

 

$query = "SELECT user_info.username, user_info.`password`, user_info.UserID, user_info.EmailAddress, user_info.Address, user_info.Postcode, user_info.FirstName, user_info.LastName FROM user_info WHERE user_info.username = \"$username\"";

 

$results = mysql_query(mysql_escape_string($query))

or die(mysql_error());

 

while ($row = mysql_fetch_array($results)) {

extract($row);

 

echo $username;

echo $password;

echo $UserID;

echo $EmailAddress;

echo $Address;

echo $Postcode;

echo $FirstName;

echo $LastName;

 

 

 

 

}

 

 

 

 

 

?>

 

 

 

 

 

[roopurt18]

You don't escape the whole SQL string; only the variables you substitute into it.

[roopurt18]

And strings in MySQL are surrounded by single quotes, not double quotes.

[dhillon555]

Does anybody know if the below code is correct I am getting the error

 

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\"tom\"' at line 1

 

 

 

 

$username = ($_SESSION['myusername']);

 

$query = "SELECT user_info.username, user_info.`password`, user_info.UserID, user_info.EmailAddress, user_info.Address, user_info.Postcode, user_info.FirstName, user_info.LastName FROM user_info WHERE user_info.username = '$username'";

 

$results = mysql_query(mysql_escape_string($query))

  or die(mysql_error());

 

while ($row = mysql_fetch_array($results)) {

  extract($row);

 

  echo $username;

  echo $password;

  echo $UserID;

  echo $EmailAddress;

  echo $Address;

  echo $Postcode;

  echo $FirstName;

  echo $LastName;

 

 

 

 

}

 

 

 

 

 

?>

 

[Ken2k7]

Use mysql_real_escape_string on $username like you had it on the first post. roopurt18 was telling you to escape the username string, but not the SQL as a whole, meaning the function call to mysql_escape_string() inside mysql_query() should be removed.

[roopurt18]

<?php

$username = mysql_real_escape_string($_SESSION['myusername']); // escape input going INTO the database

$query = "SELECT user_info.username, user_info.`password`, user_info.UserID, user_info.EmailAddress, user_info.Address, user_info.Postcode, user_info.FirstName, user_info.LastName FROM user_info WHERE user_info.username = '$username'";

$results = mysql_query($query) // DONT escape the entire SQL query...BAD BAD BAD
   or die(mysql_error());
   
while ($row = mysql_fetch_array($results)) {
   extract($row);
   
   echo $username;
   echo $password;
   echo $UserID;
   echo $EmailAddress;
   echo $Address;
   echo $Postcode;
   echo $FirstName;
   echo $LastName;
   
   
   
   
}
?>

 

Bleh, ken beat me to it!