MySQL error when submitting form

Ted_Striker

Hi, I'm trying to figure out what's causing a MySQL error that's generated after I submit a form.

This is what my form looks like:

<form name="newarticle" action="editarticles.php" method="POST">

<font size=2>

<tr><td>Content</td><td><textarea name="articles_content" rows="10" cols="30"><?php echo $articles_content ?></textarea></td><tr>
<tr><td><input type=hidden name="articles_ID" value=<?php echo $articles_ID ?>name="newarticle"><input type=submit value="submit"></td>

<td><input type=Reset name="reset" value="Reset"></td></tr>
</font>
</form>
</table>

This is the query:

$query="UPDATE articles
          SET articles_content=".$_POST['articles_content']."
          WHERE articles_ID=".$_POST['articles_ID'];
  $result=mysql_query($query,$connect);

I get the MySQL error on the last line in the code below:

$query="SELECT articles_ID,articles_content FROM articles WHERE articles_ID=".$_GET['articles_ID'];

$result=mysql_query($query,$connect);
$row=mysql_fetch_row($result);

I double checked for spelling mistakes and syntax errors and could not find any. I think the form structure and the way it's handled is correct too.

Can anyone spot the problem? Thanks.

TheDefender

Just stabbing in the dark here without knowing what the actual error is that you are receiving, but here goes:
Try changing this query to this:

$query="UPDATE articles SET articles_content='".$_POST['articles_content']."' WHERE articles_ID='".$_POST['articles_ID']."'";

And this one to this (in addition to reworking the quotes a bit, I changed it to POST instead of GET):

$query="SELECT articles_ID,articles_content FROM articles WHERE articles_ID='".$_POST['articles_ID']."'";

If that doesn't work, then post back and let us know what the actual error you are getting is.

rachel2004

Originally posted by Ted Striker
Hi, I'm trying to figure out what's causing a MySQL error that's generated after I submit a form.

This is what my form looks like:

This is the query:
$query="UPDATE articles
          SET articles_content=".$_POST['articles_content']."
          WHERE articles_ID=".$_POST['articles_ID'];
  $result=mysql_query($query,$connect);
[/B]

Is there a reason that you're not using mysql_error() function? Try this in your develpment code:

$result=@myql_query($query, $connect) or die("<p>Couldn't perform update: <strong>".mysql_error()."</strong></p>");

You had a few other probs that I spotted, but it's better to let you use tools provided by PHP to troubleshoot. It's not a good idea to take $POST or $GET variables and plug them directly into your SQL statements (or use them anywhere else in your script, for that matter) without first sanitizing them. Otherwise you run the risk of foul language being inserted, invalid characters, cross-site scripting, etc.

Ted_Striker

Thanks for the help/tips.

Originally posted by TheDefender

Try changing this query to this:
$query="UPDATE articles SET articles_content='".$_POST['articles_content']."' WHERE articles_ID='".$_POST['articles_ID']."'"; 
I made the change and but I don't think it made a difference.

Originally posted by TheDefender

And this one to this (in addition to reworking the quotes a bit, I changed it to POST instead of GET):
$query="SELECT articles_ID,articles_content FROM articles WHERE articles_ID='".$_POST['articles_ID']."'"; 

When I changed it to POST, the article wouldn't show up in the form so I changed it back. The ID is passed from a link from the members page and I think that it has to be passed as GET.

Originally posted by TheDefender

If that doesn't work, then post back and let us know what the actual error you are getting is. [/B]

I'm getting this error message:

Warning: mysql_fetch_row(): supplied argument is not a valid MySQL result resource in C:\apache\htdocs\members2\editarticles.php on line 23

Originally posted by rachel2004

Is there a reason that you're not using mysql_error() function?

I didn't think of using that. I'm now using the code you posted but the error must be somewhere else because it didn't change the error message I'm getting.

I'll have to plug that code into the other query as well.

I have set some variables:
$articles_ID = $row[0];
$articles_content = $row[1];

I'm sure my code is not secure but for now I'm just trying to get everything to work properly. If you guys want me to post the entire code let me know.

rachel2004

In your original post, you need to look at your <input> fields. Notice that you are missing quotation marks around some of the attributes for your <input> tags? Fix those problems so you know that your actual HTML form is correct before you move on to trying to find the problem in the PHP code.

You're also missing the semicolon at the end of your PHP echo statemensts for the value attribute in your <input> tags.

Also, your error message indicates a problem at line 23. I can't tell which line in your code is line 23 without you indicating it, but judging from the message, you need to make sure that your db connection handle is correct. That's just an assumption right now until I can see what exactly is line 23.

Ted_Striker

Hey rachel2004,

I corrected the problems with the missing semicolons and quotation marks. I also used the error checking code you posted. It's very handy! However, I still can't figure out where the problem is. The error message says:

Couldn't perform update: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1

Here's my entire code...I know you don't need to see it all since the error seems to be at the start, but I'm not familiar with how accurate this error checking code is so I'll just post the whole thing.

<?php
require_once("connect.php");
// check session variable
  if (isset($_SESSION['valid_user'])) 
  {
      echo '<p>You are logged in as '.$_SESSION['valid_user'].'</p>';


// Selects the fields that will be displayed

$query="SELECT articles_ID,articles_content FROM articles WHERE articles_ID=".$_GET['articles_ID'];

$result=@mysql_query($query, $connect) or die("<p>Couldn't perform update: <strong>".mysql_error()."</strong></p>");
//$result=mysql_query($query,$connect);
$row=mysql_fetch_row($result);

///////////////////////////////////////////////////////////////////////////////
// print_r function shows that ID = $row[0] and content = $row[1]//////////////
///////////////////////////////////////////////////////////////////////////////
    $articles_ID = $row[0];
    $articles_content = $row[1];

//print_r($row);//this should print all the contents of the $row array for testing purposes.

?>



<html>
<head>
<title>Edit Article</title>
</head>

<body>

<table>
<?php 
//////////////////////////////////////////////////////////////////////////////////
//  This is the form/////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////////////////
?>
<form name="newarticle" action="editarticles.php" method="POST">  

<font size=2>

<tr><td>Content</td><td><textarea name="articles_content" rows="10" cols="30"><?php  echo $articles_content; ?></textarea></td><tr>
<tr><td><input type="hidden" name="articles_ID" value="<?php echo $articles_ID; ?>"><input type=submit value="submit"></td>

<td><input type=Reset name="reset" value="Reset"></td></tr>
</font>
</form>
</table>


<?php


// This receives and handles the data generated from the form     


 if ($_POST['submit'] == "submit")   //This means the form HAS been submitted:
 {

  $query="UPDATE articles SET
  articles_content='".$_POST['articles_content']."' WHERE
  articles_ID='".$_POST['articles_ID']."'";
  $result=@mysql_query($query, $connect) or die("<p>Couldn't perform update: <strong>".mysql_error()."</strong></p>");


  //IF (mysql_query($query,$connect)) {  OLD CODE

IF ($result) {
 echo "Article has been edited \n";
 echo "<a href='addarticles.php'>Click here to add another article</a>";


  }else {
  	echo "System error.  Article was not edited\n";
  }
 }

  mysql_close($connect);

  }


// Not logged in


else
  {
    echo '<p>You are not logged in.</p>';
    echo '<p>Only logged in members may see this page.</p>';
  }

echo '<a href="authmain.php">Back to main page</a>';

  ?>

rachel2004

TheDefender pointed this out earlier, but I noticed that you didn't follow his suggestins in the latest code that you posted: you aren't passing any values through the URL, so you should be using $POST instead of $GET. However, in my examples that follow, I will leave it as $GET. Be aware that in your next draft of the code, you need to change it from $GET to $_POST. This line right here:

// Selects the fields that will be displayed

$query="SELECT articles_ID,articles_content FROM articles WHERE articles_ID=".$_GET['articles_ID'];

Are you even sure that $_GET['articles_ID'] contains a value? That could be why the SELECT statement is erroring on you. Use an echo statement before the query so you can see what you're providing to the query:

echo "Value is: ".$_GET['articles_ID'];
// Selects the fields that will be displayed

$query="SELECT articles_ID,articles_content FROM articles WHERE articles_ID=".$_GET['articles_ID']; 

exit("<li />End of developement code.");

Another way to troubleshoot this is to echo out the actual query:

// Selects the fields that will be displayed

$query="SELECT articles_ID,articles_content FROM articles WHERE articles_ID=".$_GET['articles_ID']; 

echo $query;

and see what it says. I didn't look through everything you posted, so you may have other problems, but try those echo statements first.

Ted_Striker

I did follow TheDefender's advice but it didn't seem to make a difference and after I changed other parts of the code, I tried changing GET to POST again and when I did that, the form would no longer be displayed.

When I echo the query I get this:
SELECT articles_ID,articles_content FROM articles WHERE articles_ID=98
And the form with the current content is displayed.

However, when I change GET to POST the error message I got before appears right away when I go to the page.

Is it possible that the syntax error is actually elsewhere?

Edit: I also printed the value of passed from GET before the query and it worked - Value is: 98