[SOLVED] IE8 throwing an SQL error?

[mayfair]

Hi guys

 

Out of sheer morbid curiosity I "upgraded" to IE8 yesterday. Now my life has broken! I have a simple calculator that posts to a PHP script (code below) to do the number crunching and return everything as SESSION vars. Everything works nicely in FF and IE7.. but after installing IE8 im getting:

 

"Query failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'FROM rates' at line 1"

 

I've tried searching for the answer to this but to be honest I don't even know why it's being caused. I'll post the PHP below, any help would be greatly appreciated 

 

<?php session_start();

require ('../include/connect.php'); // Establish database connection

// Get POST info
$_SESSION['currency'] = $_POST['currency'];
$_SESSION['delivery_period'] = $_POST['delivery_period'];
$_SESSION['amount'] = $_POST['amount'];

// Concatenate required rate
$rate = $_SESSION['currency'].$_SESSION['delivery_period'];

// Get rate
$result = mysql_query("SELECT $rate FROM rates") or die ("Query failed: ".mysql_error()); // Run SELECT query	 
$value = mysql_fetch_array($result) or die (mysql_error()); // Store results

$r = $value[$rate];

// Calculate and return total
$_SESSION['total'] = $_SESSION['amount'] / $r;

mysql_close(); // Close database connection

// Re-direct back to previous page
$ref = $_SERVER['HTTP_REFERER'];
header( 'refresh: 0; url='.$ref);

?>

[akitchin]

the issue is with an SQL statement, and therefore the only way IE could be affecting it differently than other browsers (since it's a server-side statement) is through its handling of sessions. check your privacy settings on IE8; could be that its default is to reject all cookies, thereby killing sessions. as a simple verification, try echoing your SESSION vars when viewing with IE8.

 

i vaguely recall old version of IE requiring the header "Cache-control: private" along with sessions, but i could be wrong. google IE8 and session handling and you may get some answers if the privacy settings aren't the issue.

 

EDIT: premature posting - see the post below. i didn't notice the SESSION vars are being assigned directly from POST vars in the same section.

[PFMaBiSmAd]

$rate is not set in your query. That means that the $_POST data that produces $rate is not set. I would suspect that your form is invalid HTML. You would need to post your form for anyone in a forum to be able to help with what it is doing.

[mayfair]

Thank you both for your replies. I have tried echoing $rate before it is used in the SQL query and it forms exactly as it need it to which indicates that POST is working fine.

 

I have also tried concatenating $rate from the $_POST vars instead of the $_SESSION ones, but still get the same problem. I'll have a look around google for IE8 session handling and see if I can figure out what's going on!

[akitchin]

Thank you both for your replies. I have tried echoing $rate before it is used in the SQL query and it forms exactly as it need it to which indicates that POST is working fine.

 

I have also tried concatenating $rate from the $_POST vars instead of the $_SESSION ones, but still get the same problem. I'll have a look around google for IE8 session handling and see if I can figure out what's going on!

 

if it fails to work in IE8 even when using the POST-concatenated $rate variable, it's not IE8's session handling that is to blame. there's no real reason for IE8 to fail vs. any other browser if it's passing back the same form info that other browsers are, because beyond that, it's the server's duty. are you absolutely certain that only the browser has changed between attempts? did you maybe change the data submitted via the form?

[PFMaBiSmAd]

It's because of the referrer not being set (and you should only use $_SERVER['HTTP_REFERER'] for informational purposes, not for any functional code.)

 

When you echo $rate, that produces output that prevents the header() from doing anything. When you don't echo anything that allows the header() to work, but because $_SERVER['HTTP_REFERER'] is empty, your redirect to the same page but the $_POST variables are empty the second time and you get an sql error.

 

Don't rely on $_SERVER['HTTP_REFERER'] for any function in your code.

[mayfair]

Well that's what I would have thought too, but it doesn't seem to be the case. I've just tested this on a colleagues computer who's running IE7 and it's working fine. It's also good on FF, its just IE8 that is causing problems. Very strange? 

 

Edit: Posted before I saw reply. Thank you PFMaBiSmAd, that was the problem. I stole the code from somewhere else as a quick way to redirect the user back to the previous page, guess I should've done my homework! Appreciate the help bud

[PFMaBiSmAd]

So, that would mean that IE8 is not setting the referrer.

 

Move you session_start(); down to its' own line and add the following two lines of code immediately after the first opening <?php tag (before the session_start()) -

 

ini_set("display_errors", "1");
error_reporting(E_ALL);

[mayfair]

Yes that's fantastic.. it's working now? Sorry to be a pain, can you explain what that's done? I can't see how turning on error_reporting and moving the session_start has made a difference!

[akitchin]

Yes that's fantastic.. it's working now? Sorry to be a pain, can you explain what that's done? I can't see how turning on error_reporting and moving the session_start has made a difference!

 

it's for future reference. the session_start() movement was a better-practice thing, the error code helps you debug future scripts (remove before putting these scripts into production, of course).

[mayfair]

Aha I see. Well I learnt something new today 

 

Thanks for your help.

[PFMaBiSmAd]

I really doubt that anything you just changed in the file caused it to start working. It is more likely that how you are reaching the page changed and $_SERVER['HTTP_REFERER'] is now being set by the browser.

 

Your code must check that $rate contains an expected value before blindly executing a query using it. You must also check that $_SERVER['HTTP_REFERER'] contains an expected value before blindly using it in a redirect.

[mayfair]

Your code must check that $rate contains an expected value before blindly executing a query using it.

 

Of course  I haven't written any validation yet, im still a long way from being finished. Appreciate the help though.