mysql syntax error...

[Patrick3002]

This seems impossible to fix but i kno its probably going to be simple i just cannot figure it out to save my life.

 

My error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near: 't even gotta wonder
I was voted number one rapper to drop 

 

My code:

$sql = "INSERT INTO `$table` VALUES ('$pc', '$pBy', '$email', '$lyric', '$song', '$artist', '$date','','')";
mysql_query($sql);

 

Now, i know the problem i just cannot solve it... Theres a problem when i enclose the $lyric var with ' and ' but, i've tried enclosing it with everything possible even \" but it just does not want to execute.

 

Any help on this problem would be greatly appreciated.

[sspoke]

VALUES ('$pc', '$pBy', '$email', '$lyric', '$song', '$artist', '$date','','')

 

here doesn't show nothing the stucture it self has to show how that table is made thats the key in your problem

[Patrick3002]

So how would i go about restructuring my query? Do you need more code?

[papaface]

what is in $table?

[Patrick3002]

$table="lyrics_01";

[sspoke]

INSERT INTO table (pc, pBy , email,lyrics,song,artist,date,blank,blank)

VALUES ('$pc', '$pBy', '$email', '$lyric', '$song', '$artist', '$date','','')

 

like that.. BUT I guessed the sturcture it wont work rofl.. U gotta fill it out your self

[corbin]

Actually sspoke, if that is the number of columns, it should work fine.

 

What exactly is lyric?  Also, I would try mysql_escape_real_string or addslashes on it.

[linuxdream]

You don't need to know the structure...you can jump directly to VALUES if each value corresponds to your table structure. Try enclosing the $table in '{$table}' instead. You don't really need the 's there unless you have a weird table name. So try {$table} too..

[Patrick3002]

I've tried

$sql = "INSERT INTO `$table` (pc, pBy, email, lyric, song, artist, date) VALUES ('$pc', '$pBy', '$email', '$lyric', '$song', '$artist', '$date','','')";
mysql_query($sql);

 

And i've also tried {$table}

 

no luck... i appreciate all of the help

[linuxdream]

are those back tick's you are using for $table? try using just regular '

[Patrick3002]

The lyric var is:  FIELD:lyric  TYPE:blob  ATTRIBUTES:BINARY  NULL:No 

in phpmyadmin.

 

But its technically song lyrics so basic text and chars such as: ' " [ ] etc.

 

Thats what that var ($lyric) contains.

 

The $table var just contains the table name (Lyrics_01) thats all that var contains, the var that has a problem is $lyric.

$table="lyrics_01";

 

Heres the link if you can figure it out that way, click Add Lyric at the top.

 

http://patricks.kicks-ass.net/lyrics/

[hitman6003]

are those back tick's you are using for $table? try using just regular '

 

If you are going to wrap a table or column name in anything it has to be a back-tic....as stated on this page in the mysql manual:

 

http://dev.mysql.com/doc/refman/5.0/en/identifiers.html#id2817618

[Jessica]

$lyric = mysql_real_escape_string($lyric);

$sql = "INSERT INTO `$table` VALUES ('$pc', '$pBy', '$email', '$lyric', '$song', '$artist', '$date','','')";

mysql_query($sql);

[Patrick3002]

$lyric = mysql_real_escape_string($lyric);

$sql = "INSERT INTO `$table` VALUES ('$pc', '$pBy', '$email', '$lyric', '$song', '$artist', '$date','','')";

mysql_query($sql);

 

Problem solved, thank you very much now i need to research mysql_real_escape_string to see exactly what that does so i understand whats going on, haha thanks alot man!

[linuxdream]

If you are going to wrap a table or column name in anything it has to be a back-tic....as stated on this page in the mysql manual:

 

Thanks,

Seems to work without them though.

[hitman6003]

Seems to work without them though.

 

It isn't necessary to quote the table and column names except in certain situations, however you can not use a single quote when you do.

[The_Assistant]

you could also use addslashes on $lyric

 

$lyric = addslashes($lyric);
$sql = "INSERT INTO `$table` VALUES ('$pc', '$pBy', '$email', '$lyric', '$song', '$artist', '$date','','')";
mysql_query($sql);

[Jessica]

No, you should use the database specific functions. If you're using mysql, use the mysql functions.

http://us3.php.net/manual/en/security.database.sql-injection.php

"Quote each non numeric user supplied value that is passed to the database with the database-specific string escape function"