Need help with this

[tartou2]

hello everyone

I don't know if php started to change syntax but today i have faced this problem.

This is the code

				
mysql_query("insert into log(user_id,receiver_email,subject,message) values('$userid','$email','$subject','$message')")or die(mysql_error());

 

and I am getting this error

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'log(user_id,receiver_email,subject,message) values('1','test@test.com' at line 1

 

I don't know what the hell is this problem. This is the first time to have such error.

Anyone can help me here.

Thanks

[trq]

It is a MySql error not a php one.

 

Do yourself a favour and echo your query.

 

$sql = "insert into log (user_id,receiver_email,subject,message) values ('$userid','$email','$subject','$message')";
if (!mysql_query($sql)) {
  trigger_error(mysql_error() . "<br />$sql");
}

[tartou2]

i did that but nothing was echoed and no data have been inserted in the database 

[garethhall]

Hi, Please update code to:

$sql = "insert into log (user_id,receiver_email,subject,message) values ($userid,'$email','$subject','$message')";

 

If it still does not work please verify that there is a mysql connection. Typically we pass mysql_query($sql, $connection) how the connection is not required but it depends on your code. So verify you can do a simple select from the DB

[revraz]

Wonder if LOG is now a reserved word.  Try putting `backticks` around it.

[trq]

i did that but nothing was echoed and no data have been inserted in the database 

 

Turn error reporting to E_ALL & display errors on then.

[tartou2]

Hi, Please update code to:

$sql = "insert into log (user_id,receiver_email,subject,message) values ($userid,'$email','$subject','$message')";

 

If it still does not work please verify that there is a mysql connection. Typically we pass mysql_query($sql, $connection) how the connection is not required but it depends on your code. So verify you can do a simple select from the DB

 

nope not working.

No error was echoed using the trigger error and got the same the same error using the or die error and still no data is inserted in the database.

 

And yes there is connection to the database. This is a peace of the code. there is select syntax in the same page everything seems to be working just fine expect this syntax.

[tartou2]

Wonder if LOG is now a reserved word.  Try putting `backticks` around it.

 

i tried changing the word log to test and still the same problem

[tartou2]

i did that but nothing was echoed and no data have been inserted in the database 

 

Turn error reporting to E_ALL & display errors on then.

 

ok this time i got to many notice which are not important and the same error was echoed

[tartou2]

ok i have located the problem.

it is somewhere here

if($mode=='t')  {
	$canSend=$_POST['canSend'];
	if($canSend==1) {
		$name=$_POST['txtName'];
		$useremail=$HTTP_SESSION_VARS['useremail'];
		if($name=="" || $name=="Your Friend\'s Name") $nameflag=1;
		$email=$_POST['txtEmail'];
		if($email=='') {
			$mailflag=1;
		}
		$re_user    = "^[a-z0-9\._-]+"; 
		$re_delim   = "@"; 
		$re_domain  = "[a-z0-9][a-z0-9_-]*(\.[a-z0-9_-]+)*"; 
		$re_tld     = "\.([a-z]{2}|aero|arpa|biz|com|coop|edu|gov|info|" . "int|mil|museum|name|net|org|pro)$"; 
		if(eregi($re_user . $re_delim . $re_domain . $re_tld, $email)==0){
			$mailflag=1;
		}
		$subject=$_POST['txtSubject'];
		if($subject=="" || $subject=="Your Subject Here") $subjectflag=1;
	  $str=$_POST['txtMessage'];
	  $order   = array("\r\n", "\n", "\r");
	  $replace = '<br />';
	  $message = str_replace($order, $replace, $str);
		if($message=='') $messageflag=1;

		if($nameflag!=1 && $mailflag!=1 && $subjectflag!=1 && $messageflag!=1) {
			$message.="<br><a href='".$strsite."?".$username."'>".$strsite."?".$username."</a>";
			$headers  = "MIME-Version: 1.0\r\n";
			$headers .= "Content-type: text/html; charset=iso-8859-1\r\n";
			$headers .= "From: ". $useremail."\r\n";		
			$mail=mail($email,$subject,$message,$headers);

mysql_query("insert into log (user_id,receiver_email,subject,message) values ($userid,'$email','$subject','$message')");

			if($mail) $sucess_flag=1;
			else $failure_flag=1;							
		}
	}
}		

 

I have changed the position of the insert syntax and there was data sent to the database.

 

Maybe someone can help me finding the error and to solve it

[trq]

Echo your query!!!!

[tartou2]

Echo your query!!!!

 

ok i did and all data have shown and it even send the email to it's destination but it doesn't insert data in the database from the place where it is placed now.

[tartou2]

ok now i am sure that the problem is somewhere here but i can't find it

if($nameflag!=1 && $mailflag!=1 && $subjectflag!=1 && $messageflag!=1) {
			$message.="<br><a href='".$strsite."?".$username."'>".$strsite."?".$username."</a>";
			$headers  = "MIME-Version: 1.0\r\n";
			$headers .= "Content-type: text/html; charset=iso-8859-1\r\n";
			$headers .= "From: ". $useremail."\r\n";		
			$mail=mail($email,$subject,$message,$headers);

mysql_query("insert into log (user_id,receiver_email,subject,message) values ($userid,'$email','$subject','$message')");

			if($mail) $sucess_flag=1;
			else $failure_flag=1;							
		}

[BlueSkyIS]

also, make sure the query doesn't produce an error by checking mysql_error()

 

$sql = "insert into log (user_id,receiver_email,subject,message) values ($userid,'$email','$subject','$message')";
mysql_query($sql) or die(mysql_error() . " IN $sql");

[garethhall]

If the sql is correct then I suspect it could be something with data you are inserting. Perhaps one of the variables is containing an invalid character and that is breaking the sql. It's bad practice to not check your data anyway so lets fix that first and hopefully it will work.

 

<?php
/*** Protect Variables from SQL injection ***/
function cv($value){
if (get_magic_quotes_gpc()){
	$value = stripslashes($value);
}
if (!is_numeric($value)){
	$value = "'" . mysql_real_escape_string($value) . "'";
}
return $value;
}

if($mode=='t')  {
	$canSend=$_POST['canSend'];
	if($canSend==1) {
		$name=$_POST['txtName'];
		$useremail=$HTTP_SESSION_VARS['useremail'];
		if($name=="" || $name=="Your Friend\'s Name") $nameflag=1;
		$email=$_POST['txtEmail'];
		if($email=='') {
			$mailflag=1;
		}
		$re_user    = "^[a-z0-9\._-]+"; 
		$re_delim   = "@"; 
		$re_domain  = "[a-z0-9][a-z0-9_-]*(\.[a-z0-9_-]+)*"; 
		$re_tld     = "\.([a-z]{2}|aero|arpa|biz|com|coop|edu|gov|info|" . "int|mil|museum|name|net|org|pro)$"; 
		if(eregi($re_user . $re_delim . $re_domain . $re_tld, $email)==0){
			$mailflag=1;
		}
		$subject=$_POST['txtSubject'];
		if($subject=="" || $subject=="Your Subject Here") $subjectflag=1;
	  $str=$_POST['txtMessage'];
	  $order   = array("\r\n", "\n", "\r");
	  $replace = '<br />';
	  $message = str_replace($order, $replace, $str);
		if($message=='') $messageflag=1;

		if($nameflag!=1 && $mailflag!=1 && $subjectflag!=1 && $messageflag!=1) {
			$message.="<br><a href='".$strsite."?".$username."'>".$strsite."?".$username."</a>";
			$headers  = "MIME-Version: 1.0\r\n";
			$headers .= "Content-type: text/html; charset=iso-8859-1\r\n";
			$headers .= "From: ". $useremail."\r\n";		
			$mail=mail($email,$subject,$message,$headers);

			$sql = "INSERT INTO log (user_id,receiver_email,subject,message) values (
							".cv($userid).",
							".cv($email).",
							".cv($subject).",
							".cv($message).")";

			if(mysql_query($sql)){
				// insert ok
			}else{
				//insert failed
			}

			if($mail) $sucess_flag=1;
			else $failure_flag=1;							
		}
	}
}
?>

[trq]

Echo your query!!!!

 

ok i did and all data have shown and it even send the email to it's destination but it doesn't insert data in the database from the place where it is placed now.

 

Show us exactly what the query looked like (eg copy and paste it).