$php_mysql$ Posted August 10, 2011 Share Posted August 10, 2011 whenever i try to insert data like $page = $_GET['page']; if(!$page >= 1){ $page = 1; } $records_per_page = 5; if($page == 1) $first_record = 0; else{ $first_record = (($page - 1) * $records_per_page ); } in my form get the error message You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'page']; if(!$page >= 1){ $page = 1; } $records_per_page = 5; if($page == 1)' at line 11 but else my form works fine even if i insert html tags in the textarea field, what could be causing this? Quote Link to comment https://forums.phpfreaks.com/topic/244430-you-have-an-error-in-your-sql-syntax/ Share on other sites More sharing options...
TeNDoLLA Posted August 10, 2011 Share Posted August 10, 2011 The error is in your SQL and the code you provided has nothing to do with that error (or it could have, if you use the variables in this code but still can't say shit with that code why your SQL query fails). Quote Link to comment https://forums.phpfreaks.com/topic/244430-you-have-an-error-in-your-sql-syntax/#findComment-1255436 Share on other sites More sharing options...
$php_mysql$ Posted August 10, 2011 Author Share Posted August 10, 2011 very strange, now that i used mysql_real_escape_string in the "..desctiption." it do not show error Quote Link to comment https://forums.phpfreaks.com/topic/244430-you-have-an-error-in-your-sql-syntax/#findComment-1255441 Share on other sites More sharing options...
TeNDoLLA Posted August 10, 2011 Share Posted August 10, 2011 very strange, now that i used mysql_real_escape_string in the "..desctiption." it do not show error So you had some characters in the description like apostrophes that needs to be escaped so they don't break the query structure. Quote Link to comment https://forums.phpfreaks.com/topic/244430-you-have-an-error-in-your-sql-syntax/#findComment-1255442 Share on other sites More sharing options...
$php_mysql$ Posted August 10, 2011 Author Share Posted August 10, 2011 i was trying to insert $page = $_GET['page']; into description, i thought escape string in description is not necessary Quote Link to comment https://forums.phpfreaks.com/topic/244430-you-have-an-error-in-your-sql-syntax/#findComment-1255444 Share on other sites More sharing options...
TeNDoLLA Posted August 10, 2011 Share Posted August 10, 2011 i was trying to insert $page = $_GET['page']; into description, i thought escape string in description is not necessary It is needed for every single bit of data input that you can't control, this including all POST and GET data. Quote Link to comment https://forums.phpfreaks.com/topic/244430-you-have-an-error-in-your-sql-syntax/#findComment-1255446 Share on other sites More sharing options...
$php_mysql$ Posted August 10, 2011 Author Share Posted August 10, 2011 thanks got to keep that in mind Quote Link to comment https://forums.phpfreaks.com/topic/244430-you-have-an-error-in-your-sql-syntax/#findComment-1255447 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.