Jump to content

problem with mysqli


lional

Recommended Posts

Hi All

I am converting my scripts from mysql to mysqli and I am having some difficulty

$query = mysqli_query($conn,"SELECT * FROM products WHERE prod_id IN (");
foreach ($_SESSION['cart'] as $key => $value) {
$query .= $key . ',';
}
$query = substr ($query, 0, -1) . ')';
$result = mysqli_query($conn, $query) or die(mysqli_error($conn));

			while ($row = mysqli_fetch_array($query, MYSQLI_ASSOC)) {
			
	 
      
			
	
}

I get the following error

 

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1111)' at line 1

 

I have tried to change it with my limited knowkledge. I am not asking for the answer just to point me in the right direction.

 

Any help will be appreciated

Link to comment
Share on other sites

Also, a major point of the newer DB classes is to allow the use of prepared statements so that you're not creating SQL injection opportunities like you've done here. Personally, I recommend PDO over Mysqli as I find it easier to use, but it may not be possible for you to switch at this point in your project. Either way, do some research on prepared statements - it'll make your life much easier (and safer) in the long run.

Link to comment
Share on other sites

1 - why are you even doing a query on line1 (where the error is coming from)?

 

2 - your foreach is pulling the key value from an array to use as the 'value' of a query statement.  Is that what you want?  Seems like you would want ot use the $value of the array loop, not the key.

Link to comment
Share on other sites

Not tested

 

//Get all of the IDs of the cart items
$cartIDs = isset($_SESSION['cart']) ? array_keys($_SESSION['cart']) : array();
//Filter out non-integer values
$cartIDs = array_filter(array_map('int_val', $cartIDs));
//Verify that valid values were passed
if(!count($cartIDs))
{
    //Error condition
    echo "No valid cart items passed";
}
else
{
    //Create the query
    $query = "SELECT * FROM products WHERE prod_id IN (" . implode(',', $cartIDs) . ")";
    //Run the query
    $result = mysqli_query($conn, $query) or die(mysqli_error($conn));
    while ($row = mysqli_fetch_array($query, MYSQLI_ASSOC))
    {
        //Do something with $row
    }
}
Link to comment
Share on other sites

I'm having a déjà vu.

 

We've gone through this exact problem back in 2016. The OP has been told over and over and over again to either switch to PDO or finally learn mysqli. There was never any reaction, and now we're back to square one.

 

At this point, I think everything as been said by everybody. Now it's up to the OP to actually absorb the information.

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.