[SOLVED] Query Getting whiespace error

[cooldude832]

I've tried moving stuff around changing quotes still get a whitespace escaped error

here is the query

<?php
mysql_query("INSERT INTO `items` 
	(`Status`,`Attack`,`Defense`,`HP`,`ItemClass`,`Version`) 
	VALUES('0','$items['attack']','$items['defense']','$items['hp']','$item['class']','$_POST['version']')"
	or die(mysql_error());
?>
{/code]

[hackerkts]

Try this,

<?php
mysql_query("INSERT INTO `items`
	(`Status`,`Attack`,`Defense`,`HP`,`ItemClass`,`Version`)
	VALUES('0','$items["attack"]','$items["defense"]','$items["hp"]','$item["class"]','$_POST["version"]')"
	or die(mysql_error());
?

[cooldude832]

now i get:

 

Parse error: syntax error, unexpected '"', expecting T_STRING or T_VARIABLE or T_NUM_STRING in /hsphere/local/home/pira00/pira00.worldispnetwork.com/kash/createitem.php on line 76

 

line 76 is:

VALUES('0','$items["attack"]','$items["defense"]','$items["hp"]','$item["class"]','$_POST["version"]')"

[cooldude832]

i fixed the $item to $items on class, but now my server is lagging

[cooldude832]

Its not liking my escape for the array keys any tips?

[marcus]

Remove the double quotes in your values.

[cooldude832]

I got it, not the way i wanted to do it take it like this

<?php

$values = "'0','".$item['attack']."','".$item['defense']."','".$item['hp']."','".$item['class']."','".$_POST['version']."'";
mysql_query("INSERT INTO `items`
	(`Status`,`Attack`,`Defense`,`HP`,`ItemClass`,`Version`)
	VALUES($values)")or die(mysql_error());
?>

[keeB]

$attack = $items['attack'];
.
.
.
.
$version = $_POST['version'];

<?php
mysql_query("INSERT INTO `items` 
	(`Status`,`Attack`,`Defense`,`HP`,`ItemClass`,`Version`) 
	VALUES('0','$attack','$items['defense']','$items['hp']','$item['class']','$version')"
	or die(mysql_error());
?>

 

 

Just finish it up.

[cooldude832]

Thats a waste in my eyes, i rather restructre $items to a flat var setting instead of array before i duplicate values

[keeB]

Well I'd much rather use a OO Concept, but I'm doing the best with what you gave me.

 

Using POST values directly in your Query string is laughable at best. It's also VERY prone to SQL Injection in it's current state.