[Resolved] Insert statement not accepting variables

jbird

I am having a problem with INSERT INTO statement. If I hard code the values into the query they get written to the database with no problem. However, if I use varibales, I get an error, could not execute query.

Do I need to specify the scope of the variable such as "form.$award" or what?

Here is my code:

////////////////////////////////////////////////////////////////////////////////

<?
if ((!$award) ||(!$song)){
header("location: awardsinput.shtml");
exit;
}

$db_name = "dbase";
$table_name = "awards";

$connection =mysql_connect ("localhost", "username", "pwd") or die ('I cannot connect to the database because: ' . mysql_error()); mysql_select_db ("carry-on_");

$db = @mysql_select_db($db_name, $connection) or die("could not select database.");

$sql = 'INSERT INTO awards ( awardID , award , song ) ';
$sql .= 'VALUES ( \'\', \'$award\', \$song\' );';
$sql .= '';;

$result = @($sql, $connection) or die("couldnt execute query.");

<html>
<head>
<title>add record</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>

<body bgcolor="#FFFFFF" text="#000000">
<h1 align="center"> Adding a record to<? echo "$table_name"; ?></h1><br>
<table width="75%" border="1" cellspacing="3" cellpadding="3">
<tr>
<tH>Award</th>
<th>Song</th>
</tr>
<tr>
<td><? echo "$award"; ?></td>
<td><? echo "$song"; ?></td>
</tr>
</table>
</body>
</html>

😕

Any pointers would be greatful

TIA
Jay

bastien

think you might need to change the code to use $POST or $GET to access the variables for the insert


$sql = "INSERT INTO `awards` ( `awardID` , `award` , `song` )"; 
$sql .= "VALUES ( null, '".$_POST['award']."', '".$_POST['song']."' )";

LordShryku

For error reporting, change your execute line

 $result = @mysql_query($sql, $connection) or die("couldnt execute query.");

// TO THIS

 $result = mysql_query($sql, $connection) or die("Error: ".mysql_error());

jbird

Thanks for the reply, I have re-written my code using your suggestions, However, the following line keeps throwing a parsing error:

$sql .= "VALUES ( null, '".$POST['award']."', '".$POST['song']."' )";

I'm trying different quote mark placement but that doesn't seem to be taking care of the problem.

Suggestions???

LordShryku

Could try it as one statement

$sql = "INSERT INTO `awards` ( `awardID` , `award` , `song` ) 
        VALUES ( null, '".$_POST['award']."', '".$_POST['song']."' )";

I don't see anything wrong with it though. May be a line above this code that's giving you the error.

jbird

Thank you, the single statement worked !

On a seperate note, would it be safe to say that when ever I refer to a form variable in a query that I should use the $Post[] or $GET[] as appropriate?

LordShryku

You should use those everywhere it applies. Check the manual for register_globals.

jbird

Thanks for the info.