PHP/MySQL Error

[madcat]

Hi-

Can someone help with this? When I first ran this script it worked fine, but a few days later it gets this error:

< You have an error in your SQL syntax near ')' at line 1 >

$sql = "CREATE TABLE $POST[table_name] (";
for ($i = 0; $i < count($POST['field_name']); $i++) {
$sql .= $POST['field_name'][$i]." ".$POST['field_type'][$i];
if ($POST['field_length'][$i] != "") {
$sql .= " (".$POST['field_length'][$i]."),";
} else {
$sql .= ",";
}
}

$sql = substr($sql, 0, -1);

$sql .= ")";

Can't figure out what is wrong since nothing has changed...

Thank you!

[stolzyboy]

have you tried echoing out $sql to ensure that it is valid sql syntax, depending on info from users

there could be characters, quotes, etc... that people are trying to use that will kill your sql statements

try using stripslashes, and htmlspecialchars, trim, etc... to clean up user entered information