Jump to content
lional

problem with mysqli

Recommended Posts

Hi All

I am converting my scripts from mysql to mysqli and I am having some difficulty

$query = mysqli_query($conn,"SELECT * FROM products WHERE prod_id IN (");
foreach ($_SESSION['cart'] as $key => $value) {
$query .= $key . ',';
}
$query = substr ($query, 0, -1) . ')';
$result = mysqli_query($conn, $query) or die(mysqli_error($conn));

			while ($row = mysqli_fetch_array($query, MYSQLI_ASSOC)) {
			
	 
      
			
	
}

I get the following error

 

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1111)' at line 1

 

I have tried to change it with my limited knowkledge. I am not asking for the answer just to point me in the right direction.

 

Any help will be appreciated

Share this post


Link to post
Share on other sites

$query is supposed to be a string. That part shouldn't have been "converted".

Share this post


Link to post
Share on other sites

Also, a major point of the newer DB classes is to allow the use of prepared statements so that you're not creating SQL injection opportunities like you've done here. Personally, I recommend PDO over Mysqli as I find it easier to use, but it may not be possible for you to switch at this point in your project. Either way, do some research on prepared statements - it'll make your life much easier (and safer) in the long run.

Share this post


Link to post
Share on other sites

1 - why are you even doing a query on line1 (where the error is coming from)?

 

2 - your foreach is pulling the key value from an array to use as the 'value' of a query statement.  Is that what you want?  Seems like you would want ot use the $value of the array loop, not the key.

Share this post


Link to post
Share on other sites

Not tested

 

//Get all of the IDs of the cart items
$cartIDs = isset($_SESSION['cart']) ? array_keys($_SESSION['cart']) : array();
//Filter out non-integer values
$cartIDs = array_filter(array_map('int_val', $cartIDs));
//Verify that valid values were passed
if(!count($cartIDs))
{
    //Error condition
    echo "No valid cart items passed";
}
else
{
    //Create the query
    $query = "SELECT * FROM products WHERE prod_id IN (" . implode(',', $cartIDs) . ")";
    //Run the query
    $result = mysqli_query($conn, $query) or die(mysqli_error($conn));
    while ($row = mysqli_fetch_array($query, MYSQLI_ASSOC))
    {
        //Do something with $row
    }
}

Share this post


Link to post
Share on other sites

I'm having a déjà vu.

 

We've gone through this exact problem back in 2016. The OP has been told over and over and over again to either switch to PDO or finally learn mysqli. There was never any reaction, and now we're back to square one.

 

At this point, I think everything as been said by everybody. Now it's up to the OP to actually absorb the information.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.