unexpected t variable

[jeff5656]

I get the above syntax error with the following code:

<?php

include connectdb.php

 

$sql = UPDATE active_consults SET

patient_name = '" . $_POST['patient_name'] . "',

mrn = '" . $_POST['mrn'] . "',

location = '" . $_POST['location'] . "',

fellow = '" . $_POST['fellow'] . "',

rcf_date = '" . $_POST['rcf_date'] . "',

admission = '" . $_POST['admission'] . "',

consult_reason = '" . $_POST['consult_reason'] . "',

impression = '" . $_POST['impression'] . "',

recs = '" . $_POST['recs'] . "',

comments = '" . $_POST['comments'] . "'

where id_incr = '". $_GET['id_incr'] . "';

 

 

?>

 

 

Thank you!

[corbin]

$sql = "UPDATE

 

missing a starting ". ;p

[uramagget]

I don't know if it was erased by posting, though shouldn't it be:

 

include "connectdb.php";

[darkfreaks]

<?php
include "connectdb.php";

$sql = "UPDATE active_consults SET
patient_name = '" . {$_POST['patient_name'] }. "',
   mrn = '" .{ $_POST['mrn'] }. "',
   location = '" . {$_POST['location']} . "',
   fellow = '" . {$_POST['fellow']} . "',
   rcf_date = '" .{$_POST['rcf_date']} . "',
   admission = '" . {$_POST['admission'] }. "',
   consult_reason = '" .{ $_POST['consult_reason']}. "',
   impression = '" . {$_POST['impression']} . "',
   recs = '" .{ $_POST['recs']} . "',
   comments = '" . {$_POST['comments']} . "'
   where id_incr = '". {$_GET['id_incr']} . "''";


?>

[wildteen88]

Try:

<?php

include 'connectdb.php';

if(isset($_GET['id_incr'] && is_numeric($_GET['id_incr']))
{
    $patient_name = mysql_real_escape_string($_POST['patient_name']);
    $mrn = mysql_real_escape_string($_POST['mrn']);
    $location = mysql_real_escape_string($_POST['location']);
    $fellow = mysql_real_escape_string($_POST['fellow']);
    $rcf_date = mysql_real_escape_string($_POST['rcf_date']);
    $admission = mysql_real_escape_string($_POST['admission']);
    $consult_reason = mysql_real_escape_string($_POST['consult_reason']);
    $impression = mysql_real_escape_string($_POST['impression']);
    $recs = mysql_real_escape_string($_POST['recs']);
    $admission = mysql_real_escape_string($_POST['admission']);
    $comments = mysql_real_escape_string($_POST['comments']);


    $sql = "UPDATE active_consults SET patient_name = '" . $patient_name . "',
                                       mrn = '" . $mrn . "',
                                       location = '" . $location . "',
                                       fellow = '" . $fellow . "',
                                       rcf_date = '" . $rcf_date . "',
                                       admission = '" . $admission . "',
                                       consult_reason = '" . $consult_reason . "',
                                       impression = '" . $impression . "',
                                       recs = '" . $recs . "',
                                       comments = '" . $comments . "'
            WHERE id_incr = '". $id . "'";
}

?>

Never place raw post/get data directly into an sql query. I have applied a  bit of basic security to your code to help prevent SQL Injection attacks

 

[darkfreaks]

i guess you could post it straight into your query but like wildteen said it is not safe at all too. Please make sure you have used sanitation beforehand.

[jeff5656]

I used the code from wildteen 88 and got this:

unexpected T_BOOLEAN_AND, expecting ',' or ')' in C:\wamp\www\consults\editpatient.php on line 6

[revraz]

Add a ) here

 

if(isset($_GET['id_incr']) && is_numeric($_GET['id_incr']))

 

[BlueSkyIS]

i find it helpful to use a code editor that complains if parentheses, brackets and other symmetrical symbols are unmatched.

[jeff5656]

Thanks for all the help so far.  I managed to get that to be without  errors, but now it seems that the variables are empty (but in the address bar I DO see the correct id:  http://localhost/consults/editpatient.php?action=edit&id=47)

For instance if i try to echo $patient_name nothing is displayed.  I added a form to the end (see code below) to try to populate it witht he fields from the record specified in id_incr, but nothing shows up (I got rid of most of the form to make it easier):

 

<?php

 

include 'connectdb.php';

 

 

 

if(isset($_GET['id_incr']) && is_numeric($_GET['id_incr']))

{

    $patient_name = mysql_real_escape_string($_POST['patient_name']);

    $mrn = mysql_real_escape_string($_POST['mrn']);

    $location = mysql_real_escape_string($_POST['location']);

    $fellow = mysql_real_escape_string($_POST['fellow']);

    $rcf_date = mysql_real_escape_string($_POST['rcf_date']);

    $admission = mysql_real_escape_string($_POST['admission']);

    $consult_reason = mysql_real_escape_string($_POST['consult_reason']);

    $impression = mysql_real_escape_string($_POST['impression']);

    $recs = mysql_real_escape_string($_POST['recs']);

    $admission = mysql_real_escape_string($_POST['admission']);

    $comments = mysql_real_escape_string($_POST['comments']);

 

 

    $sql = "UPDATE active_consults SET patient_name = '" . $patient_name . "',

                                      mrn = '" . $mrn . "',

                                      location = '" . $location . "',

                                      fellow = '" . $fellow . "',

                                      rcf_date = '" . $rcf_date . "',

                                      admission = '" . $admission . "',

                                      consult_reason = '" . $consult_reason . "',

                                      impression = '" . $impression . "',

                                      recs = '" . $recs . "',

                                      comments = '" . $comments . "'

            WHERE id_incr = '". $id . "'";

}

 

?>

<h2>Add new patient</h2>

<form name="updatepatient" method="post" action="updatepatient.php">

 

  <table width="200" border="0">

    <tr>

      <th scope="col">Patient Name</th>

      <th scope="col">MRN</th>

      <th scope="col">Loc</th>

      <th scope="col">Fellow</th>

    </tr>

    <tr>

      <td><input name="patient_name" type="text" size="20" value="<? echo $patient_name; ?>" /></td>

      <td><input type="text" name="mrn" size="10"/></td>

      <td><label>

        <input name="location" type="text" id="location" size="6" />

      </label></td>

          </tr>

  </table>

  <p> </p>

  <table width="391" border="0">

   

 

  </table>

  <label></label>

  <p>

    <input type="submit" value="Add patient" />

    <input type="reset" value="Clear all fields"/>

  </p>

</form>

[jeff5656]

BTW, the page preceding the above page is attached below, in case the problem is that this script is sending empty variables (although as I said, the correct id_incr value is displayed in the address bar:

 

<?php require('secure.php');

 

include "dateheader.php";

include "connectdb.php";

 

$query = "SELECT id_incr, patient_name, mrn, location, fellow, rcf_date, admission, consult_reason, impression, recs, comments ".

"FROM active_consults WHERE signoff_status = 'a' ".

"ORDER BY patient_name";

$results = mysql_query ($query) or die (mysql_error());

$num_pts = mysql_num_rows ($results);

 

$consultheading =<<<EOD

<table width="70%" border = "1" cellpadding = "2"

cellspacing = "2" align = "center">

 

<th> Name </th>

<th> MRN </th>

<th> Loc </th>

<th> Fellow </th>

<th> Date of Consult</th>

<th> Reason for Admssion </th>

<th> Reason for Consult  </th>

<th> Impression </th>

<th> Recs </th>

<th> Comments </th>

</tr>

EOD;

echo $consultheading;

 

while ($row = mysql_fetch_assoc ($results)) {

?>

    <tr>

    <td bgcolor="#CCCCCC" width="50%">

    <?php echo $row['patient_name'];?> </td>

    <td bgcolor="#CCCCCC" width="50%">

    <?php echo $row['mrn'];?> </td>

    <td bgcolor="#CCCCCC" width="50%">

    <?php echo $row['location'];?> </td>

    <td bgcolor="#CCCCCC" width="50%">

    <?php echo $row['fellow'];?> </td>

    <td bgcolor="#CCCCCC" width="50%">

    <?php echo $row['rcf_date'];?> </td>

    <td bgcolor="#CCCCCC" width="50%">

    <?php echo $row['admission'];?> </td>

    <td bgcolor="#CCCCCC" width="50%">

    <?php echo $row['consult_reason'];?> </td>

    <td bgcolor="#CCCCCC" width="50%">

    <?php echo $row['impression'];?> </td>

    <td bgcolor="#CCCCCC" width="50%">

    <?php echo $row['recs'];?> </td>

    <td bgcolor="#CCCCCC" width="50%">

    <?php echo $row['comments'];?> </td>

    <td bgcolor="#CCCCCC" width="50%">

    <a href="editpatient.php?action=edit&id=<?php

echo $row['id_incr']; ?>">[EDIT]</a> </td>

      </tr>

      <?php

    }

    ?>

   

<td> Total active patients: <?php echo $num_pts; ?> </td>

</tr>

 

    </table>

[darkfreaks]

<?php

require('secure.php');
include ("dateheader.php");
include ("connectdb.php");

$patient_name= strip_tags(trim( mysql_real_escape_string($_POST['patient_name'])));
    $mrn = strip_tags(trim(mysql_real_escape_string($_POST['mrn'])));
    $location = strip_tags(trim(mysql_real_escape_string($_POST['location'])));
    $fellow = strip_tags(trim(mysql_real_escape_string($_POST['fellow'])));
    $rcf_date =strip_tags(trim( mysql_real_escape_string($_POST['rcf_date'])));
    $admission =strip_tags(trim( mysql_real_escape_string($_POST['admission'])));
    $consult_reason = strip_tags(trim(mysql_real_escape_string($_POST['consult_reason'])));
    $impression =strip_tags(trim( mysql_real_escape_string($_POST['impression'])));
    $recs = strip_tags(trim(mysql_real_escape_string($_POST['recs'])));
    $comments =strip_tags(trim(mysql_real_escape_string($_POST['comments']));

if(isset($_GET['id_incr']||is_numeric($_GET['id_incr'])||
!empty($patient_name)||!empty($mrn)||
!empty($location)||!empty($fellow)||
!empty($rcf_date)||!empty($admission)||!empty($consult_reason)||
!empty($impression)||!empty($recs)||!empty($comments))
{  
     $sql = "UPDATE active_consults SET patient_name = '" . $patient_name . "',
                                       mrn = '" . $mrn . "',
                                       location = '" . $location . "',
                                       fellow = '" . $fellow . "',
                                       rcf_date = '" . $rcf_date . "',
                                       admission = '" . $admission . "',
                                       consult_reason = '" . $consult_reason . "',
                                       impression = '" . $impression . "',
                                       recs = '" . $recs . "',
                                       comments = '" . $comments . "'
            WHERE id_incr = '". $id . "'";
}

else{ die("Please go back and fill out the form <a href=>Here</a>!");}
    
    ?>

 

[revraz]

Probably because your URL contains "id" and you are getting "id_incr" ?

[darkfreaks]

that is a good possibility  reveraz but the code above should stop empty values or error