Insert query, with weird error???

bleach

Here is the form input:

<input type="text" name="content" value="" size="32">

here's the insrt query:

$sql = "INSERT INTO ".$_GET['table']."( $data ) VALUES( ".addslashes($_POST['content'])." )";

If I type test1 in the text box and submit, when I print the query I get this:

SQL: INSERT INTO tests( test ) VALUES( test1 )

the table I want to update is tests and the column is test so that looks right?

then I add this and resubmit:

$result = mysql_query($sql, $db) or die(mysql_error());

mySQL returns this error:

Unknown column 'test1' in 'field list'

LordShryku

You need to quote your values for non-numeric columns.

INSERT INTO tests( test )
VALUES( 'test1' )

Try that.

bleach

that worked i'm so retarded....

Like you said I changed this:

$sql = "INSERT INTO ".$_GET['table']."( $data ) VALUES( ".addslashes($_POST['content'])." )";

to this:

$sql = "INSERT INTO ".$_GET['table']."( $data ) VALUES( '".addslashes($_POST['content'])."' )";

and all was well... Thankyou..

philipolson

One note (a bit unrelated but important) is that you want to make sure you are familiar with the PHP directive / setting magic_quotes_gpc as it essentially runs addslashes() on all REQUEST data (GET, POST, COOKIE). So if you have it on, and also use addslashes(), you are essentially doing addslashes(addslashes($var)); which is wrong. Doing this will fill the database with stuff like \' and you'll be forced to use stripslashes() when retrieving data. The directive magic_quotes_gpc is on by default.

bleach

It's good to know that magic_quotes_gpc will perform the addslashes function for me but are you sure that is on by default though? I used the php-recommended.ini and changed a few things in there but didn't change the value for that and it was set to off. magic_quotes_runtime was also set to off in my ini.

philipolson

When someone speaks of 'default' they do not speak of php.ini-recommended but rather php.ini-dist Look on the top of php.ini-recommended for various changes it has made from the default php.ini-dist

bleach

ahhh that would explain it. :-) Thanks!