[SOLVED] Strange MySQL/PHP Script error

[neex1233]

<?php $allow = array ('2');include ("/home/Username/public_html/folder/protect.php"); ?>

<title>Delete User</title>

<?php

$con = mysql_connect("localhost","My_Username","Password");

mysql_real_escape_string(mysql_select_db("My_DB", $con));

$username = $_POST['username'];

if (isset($_POST['delete'])) {

$sql = mysql_real_escape_string(mysql_query("DELETE FROM users WHERE username = '$username'"));

mysql_query($sql)

or die (mysql_error());

}

?>

 

<strong>User Deleted</strong>

<meta http-equiv="REFRESH" content="2;url=myurl">

 

That's my whole page. As you can see, there is no '1' on the page. Here is my error:

 

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1' at line 1

 

What is wrong with this script? It really does delete the user, but I always get this error and it doesn't redirect the user to my specified page. Thank you.

[taquitosensei]

what's the first line from protect.php?

 

[PFMaBiSmAd]

What are all the lines in protect.php? Especially any query statements.

[neex1233]

I don't think it's them, because when I take the protect code off, it still doesn't work.

[PFMaBiSmAd]

Upon closer review, you are escaping the whole result of one query and putting that into another one -

 

$sql = mysql_real_escape_string(mysql_query("DELETE FROM users WHERE username = '$username'"));

 

You are supposed to only escape string data that goes into the query and $sql should be just the query string because you are then putting that into another mysql_query() statement.

[neex1233]

So where do I put the escape string?

[Maq]

He told you, put it around the string then call the mysql_query() function.

 

If you read the documentation you will see that mysql_real_escape_string takes a string and returns a string.  It wouldn't make any sense to put it around the mysql_query when that returns a resource.

[neex1233]

I did that, but I'm still getting the same error.

 

I might not have did it right, here's my new code:

 

<?php $allow = array ('5');include ("/home/username/public_html/folder/protect.php"); ?>
<title>Delete User</title>
<?php
$con = mysql_connect("localhost","Username","Password");
mysql_select_db("DB_Name", $con);
$username = $_POST['username'];
if (isset($_POST['delete'])) {
$sql = mysql_query("DELETE FROM users WHERE username = '$username'");
mysql_query(mysql_real_escape_string($sql))
or die (mysql_error());
}
?>

<strong>User Deleted</strong>
<meta http-equiv="REFRESH" content="1;url=myurl">

 

Oh yes, and the script still works, it's just the error that shows up and none of the things I put in the body.

[Maq]

Remove this line:

 

$sql = mysql_query("DELETE FROM users WHERE username = '$username'");

[neex1233]

Actually, I fixed it. Well, not really, I just removed the 'mysql_error()' line.

[taquitosensei]

that didn't fix anything.  You're just don't have any output when there's an error now.

$sql = mysql_query("DELETE FROM users WHERE username = '".mysql_real_escape_string($username)."'");

[Maq]

Actually, I fixed it. Well, not really, I just removed the 'mysql_error()' line.

 

If you want to properly fix it, implement my suggestion and post the current code.

 

(You can mark the top "Not Solved" again, by clicking the same button as marking it solved.)