Failed Query

[dodgeitorelse3]

ok so I am trying to learn to use $_POST. I have written a query with a where clause is using the $_POST but I keep getting query failed. I know the $_POST works as I can echo the value. Can anyone spot my error?

 

$result = mysql_query("select * from lgsl where `comment'= ".$POST['comment']."")
or die('Error, query failed');

Edited November 18, 2012 by dodgeitorelse3

[dannon]

`comment'

Change ' to `.

Edited November 18, 2012 by dannon

[dodgeitorelse3]

ty dannon, tried that and also added the missing underscore in $POST but still fails.

Edited November 18, 2012 by dodgeitorelse3

[Andy123]

$result = mysql_query("select * from lgsl where comment = '" . $_POST['comment'] . "'") or die(mysql_error());

 

I removed the quotes around the "comment" column name because they are not necessary - and one of them was of the wrong type. I also added quotes around the POST value you are inserting because you will be searching for a string. I also corrected $POST to $_POST to use the superglobal array.

 

If there is an error, it should now show this error because I added a function call within the die() call.

 

You should also watch out for SQL injection.

Edited November 18, 2012 by Andy123

[dannon]

$result = mysql_query("select * from lgsl where 'comment'= '".$_POST['comment']."'")

 

try this

[dodgeitorelse3]

ty guys, worked with

$result = mysql_query("select * from lgsl where `comment`= '".$_POST['comment']."'")
or die('Error, query failed'); 

now about the injection thing? Is it really something I need to worry about since I am the only one that has access to this file?

[dannon]

ty guys, worked with

$result = mysql_query("select * from lgsl where `comment`= '".$_POST['comment']."'")
or die('Error, query failed');

now about the injection thing? Is it really something I need to worry about since I am the only one that has access to this file?

If you are the only one who is going to use it then no.

But you should still learn how to prevent SQL Injections and stuff.

[dodgeitorelse3]

ok dannon I will thank you very much

[AyKay47]

Good practices should be exercised from the very beginning of learning how to code in a certain language.

In this particular case, any data that comes from a user and is used in a query needs to be properly sanitized using mysql_real_escape_string to prevent SQL Injection as noted earlier.