Error in sql syntax

Dakkar

I have a php script like this

pvp.php


<?
include("config.php");
include("gecir.php");

if(($startl == "") or ($stopl == "")) {
$startl=0;
$stopl=50;
} 

 ?>

<html>

<head>
<meta http-equiv="Content-Language" content="tr">
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
</head>

<body bgcolor="#FFFFD2">

<div align="center"><br><br>
  <center>
<form method="POST" action="arama.php"><font face="Tahoma" size="2">
Kullanici Arama: <input type="text" name="user" size="25"  style="font-family: Tahoma;font-size: 10px; font-weight: bold">
<input type="submit" value="Ara" name="Ara" style="font-family: Tahoma; font-size: 10px; font-weight: bold">
    </center></form>
<br>
<form method="POST" action="uopvpstats.php"><font face="Tahoma" size="2">
<input type="text" name="startl" size="7" value="<? echo $startl;?>" style="font-family: Tahoma;font-size: 10px; font-weight: bold"> ile 
<input type="text" name="stopl" size="7" value="<? echo $stopl;?>" style="font-family: Tahoma;font-size: 10px; font-weight: bold"> arasýnda 
<input type="submit" value="goster" name="Göster" style="font-family: Tahoma;font-size: 10px; font-weight: bold">
</form>
<br>

</div>

<div align="center">
  <center>
  <table border="1" width="60%" cellspacing="0" cellpadding="0" bordercolor="#000000">
    <tr>
      <td width="11%" align="center" bgcolor="#C0C0C0"><font face="Tahoma" size="2"><b>Siralama</b></font></td>
      <td width="30%" align="center" bgcolor="#C0C0C0"><font face="Tahoma" size="2"><b>Kullanýcý
        Adý</b></font></td>
      <td width="11%" align="center" bgcolor="#C0C0C0"><font face="Tahoma" size="2"><b>Puani</b></font></td>
      <td width="35%" align="center" bgcolor="#C0C0C0"><font face="Tahoma" size="2"><b>Guild</b></font></td>
      <td width="11%" align="center" bgcolor="#C0C0C0"><font face="Tahoma" size="2"><b>Kill Sayisi</b></font></td>
    </tr>
<?


$result = mysql_query("SELECT id FROM pvp");
$num_rows = mysql_num_rows($result);

echo "Istatistik Sistemine Kayýtli Toplam Oyuncu: $num_rows<br>";

$pfix = "LIMIT $startl , $stopl";


$result = mysql_query( "SELECT  account,name,puan,guild,kills FROM pvp order by puan desc $pfix");  

$where="";
$a = $startl; 

WHILE ($row=mysql_fetch_array($result)) {  

$a++;
$salaksco = $row['account'];
$appsco = $row['name'];
mysql_query("UPDATE pvp SET siralama='$a' WHERE account='$salaksco' and name='$appsco'");

if($row['kills']>=6)  

    $bgcol="#FF0000"; 
else  

    $bgcol="#00FF00" ;  

?>  

    <tr> 
<input type="hidden" name="id" value="<?=$row['id']?>"> 
      <td width="20%">&nbsp;<? echo "$a" ?></td> 
      <td width="29%" bgcolor="<?=$bgcol?>">&nbsp;<?=$row['name']?></td> 
      <td width="27%">&nbsp;<?=$row['puan']?></td> 
      <td width="31%">&nbsp;<?=$row['guild']?></td> 
      <td width="11%" align="center"><?=$row['kills']?></td> 
    </tr> 
<?php } ?>

  </table>
  </center>
</div>
<p>&nbsp;</p>

</body>

</html>

config.php

<?

$uname="Dakkar";
$pw="";
$server="localhost";
$db="uopvp";
$table="pvp";

mysql_connect($server,$uname,$pw) or die("Server girilemedi");
mysql_select_db($db) or die("Database Seçilemedi");


?>

gecir.php

<? 
@mysql_connect("localhost", "Dakkar", "") 
    or die("Veritabani ile baglanti kurulamadi!"); 
@mysql_select_db("uopvp") 
    or die("Veritabaninda bir hata olustu!"); 

$lines = file("C:\Serverlar\SphereR402\pvp.txt");


$i=0; 
foreach ($lines as $line_num => $line) {
$i++; 
}

for ($x=0;$x<$i;$x++) { 
list($account, $name, $puan, $kills, $guild) = explode(" ",$lines[$x]); 
$sql = "SELECT count(*) FROM pvp WHERE  account='$account' and name='$name' ";  

$res = mysql_query($sql) OR die(mysql_error());  

$row = mysql_fetch_row($res); 
   if($row[0] == 0) { 
   @mysql_query("insert into pvp  values('','$account','$name','$puan','$guild','$kills','')"); 
   } 
   else { 
   mysql_query("UPDATE pvp SET puan='$puan' WHERE account='$account' and name='$name'"); 
   mysql_query("UPDATE pvp SET guild='$guild' WHERE account='$account' and name='$name'"); 
   mysql_query("UPDATE pvp SET kills='$kills' WHERE account='$account' and name='$name'"); 
   } 
}

unlink("C:\Serverlar\SphereR402\pvp.txt");
$dosya=fopen("C:\Serverlar\SphereR402\pvp.txt","w");
fclose($dosya);
?>

when i try to run pvp.php im taking an error like this

You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'n'' at line 1

why should it be?

rachel2004

This could just be this forum removing your single backslash, but It looks like you are missing the backslash in your Windows path:

$lines = file("C:ServerlarSphereR402pvp.txt");

Use:

$lines = file("C:\\ServerlarSphereR402pvp.txt");

Use an echo statement on your SQL statement so you can see what the MySQL server is receiving:

list($account, $name, $puan, $kills, $guild) = explode(" ",$lines[$x]); 
$sql = "SELECT count(*) FROM pvp WHERE  account='$account' and name='$name' ";
echo $sql;

Dakkar

yes there was backslashes in my code but this forum removed them
But the thing that i couldnt understand is its working good on my local computer but when i upload it to my server its giving this error
what is the meaning of this error?

Dakkar

I found the problem but i couldnt find the solution
When the txt file whic i read datas from (pvp.txt in this example)become too long it gives this sql error otherwise it s working good
why should it be?

Weedpacket

What is the data that is too long? What is the type of the field into which it is being inserted? Are there apostrophes or other SQL-significant characters in the data, which means you should be using [man]mysql_escape_string[/man] so that they don't become a problem?

Just one note, you can update more than one field of a record at a time; you don't need to make three successive calls to UPDATE pvp. You can "SET name='$name', guild='$guild ', puan='$puan' WHERE ..."

Dakkar

I made my script like this but its still giving error on ' sign
how can fix it?

<? 
@mysql_connect("localhost", "Dakkar", "") 
    or die("Veritabani ile baglanti kurulamadi!"); 
@mysql_select_db("uopvp") 
    or die("Veritabaninda bir hata olustu!"); 

$lines = file("C:\Server\pvp.txt");


$i=0; 
foreach ($lines as $line_num => $line) {
$i++; 
}

for ($x=0;$x<$i;$x++) { 
list($acc, $name, $puan, $kills, $guild) = explode(",",$lines[$x]);  

$account = mysql_escape_string($acc);
$sql = "SELECT count(*) FROM pvp WHERE  account='$account' and name='$name' ";  

$res = mysql_query($sql) OR die(mysql_error());  

$row = mysql_fetch_row($res); 
   if($row[0] == 0) { 
   @mysql_query("insert into pvp  values('','$account','$name','$puan','$guild','$kills','')"); 
   } 
   else { 
   mysql_query("UPDATE pvp SET puan='$puan' WHERE account='$account' and name='$name'"); 
   mysql_query("UPDATE pvp SET guild='$guild' WHERE account='$account' and name='$name'"); 
   mysql_query("UPDATE pvp SET kills='$kills' WHERE account='$account' and name='$name'"); 
   } 
}

unlink("C:\Server\pvp.txt");
$dosya=fopen("C:\Server\pvp.txt","w");
fclose($dosya);
?>

Dakkar

any idea?

tsinka

Hi,

use mysql_escape_string on all variables (at least the ones that are not numeric) you use inside the SQL queries.

Thomas

Dakkar

Thanks everyone it works fine now