Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STR

[lankan_k3]

Hi all,

Does anybody can help me with this error...?

 

I am trying create a simple form which insert data into mysql table called 'sample'

 

Here is my code...

 

<?php

$connection = mysql_connect("localhost","root", "123");

	if(!$connection)
	{
		die("db connection error" .mysql_error());
	}

$db_select = mysql_select_db("project", $connection);

	if(!$db_select)
	{
		die("db select error" .mysql_error());
	}

$sql = "INSERT INTO sample (id,firstname,lastname,bio,gender)
	    VALUES ('$_POST['ID_']','$_POST['firstname']','$_POST['lastname']','$_POST['bio']','$_POST['gender']')";

	if(!$sql)		
	{
		die('Error: ' . mysql_error());
	}


	echo "1 record added";

?>

 

 

And every time I am getting this annoying error

 

Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in C:\wamp\www\project\process.php on line 19

 

and Line 19 is

('$_POST['ID_']','$_POST['firstname']','$_POST['lastname']','$_POST['bio']','$_POST['gender']')";

 

Thanks in advance..! :-)

[litebearer]

hint: look at when and where your single quotes open/close

[lankan_k3]

hint: look at when and where your single quotes open/close

 

 

I am sorry I still can not figure out.... :-(

[AyKay47]

1. never insert $_POST values directly into a query, this makes the script vulnerable to SQL injection.

Run the values through mysql_real_escape_string if the values are strings, and either cast them to type int or use intval for integers.

 

2. To answer your actual question, this is a concatenation error, the line in question should read:

 

$sql = "INSERT INTO sample (id,firstname,lastname,bio,gender)
	    VALUES ('{$_POST['ID_']}','{$_POST['firstname']}','{$_POST['lastname']}','{$_POST['bio']}','{$_POST['gender']}')";

[lankan_k3]

1. never insert $_POST values directly into a query, this makes the script vulnerable to SQL injection.

Run the values through mysql_real_escape_string if the values are strings, and either cast them to type int or use intval for integers.

 

2. To answer your actual question, this is a concatenation error, the line in question should read:

 

$sql = "INSERT INTO sample (id,firstname,lastname,bio,gender)
	    VALUES ('{$_POST['ID_']}','{$_POST['firstname']}','{$_POST['lastname']}','{$_POST['bio']}','{$_POST['gender']}')";

 

Hi thanks for your explanation and advice... :-) It works...

 

I just started to learn PHP a few hours ago....

 

 

 

[AyKay47]

well, whatever reference told you to add $_POST values into a query like that (if any), throw it out.

[lankan_k3]

well, whatever reference told you to add $_POST values into a query like that (if any), throw it out.

 

thanks, :-)

 

I'm following w3schools...

[AyKay47]

well, whatever reference told you to add $_POST values into a query like that (if any), throw it out.

 

thanks, :-)

 

I'm following w3schools...

 

don't.

Use a resource like tizag or books.

The PHP Manual has tuts as well.