[RESOLVED] What is wrong with my query?

homchz

I have been trying to get the file that I upload in tom y database for a few hours now.

Here is my query

$this->ad_query = mysql_query("INSERT INTO $this->ad_table (user_id, contact_name, business_email, catagory, business_name, street_address, city, state, zip_code, 
										   phone_number, fax_number, business_logo, logo_location, affiliate_bs_id, date_created, web_site) VALUES (LAST_INSERT_ID(), '$_POST[b_contact]', '$_POST[b_email]',
										   '$_POST[b_category]', '$_POST[b_name]', '$_POST[b_street]', '$_POST[b_city]', '$_POST[b_state]', '$_POST[b_zip]', '$_POST[b_phone]', '$_POST[b_fax]', '$_POST[userfile]' ,
										   'Uploads', '1', $date, '$_POST[b_web_site]')");

There is an issue here with the format at $_POST[userfile]

The only way I can get the $_POST['userfile'] to pass to the nest page is to use this

print "$_POST[userfile]";

I have tired to manipulate this query a few times with no luck.

Any thoughts?

coreyp_1

have you tried mysql_real_escape_string() ?

if that's not the problem, then we need to know what exactly is in the variable that is causing the problem. Is it the file name, or is it an image stream itself?

homchz

I have tried this but now nothing returns

mysql_query("INSERT INTO $this->ad_table (user_id, contact_name, business_email, catagory, business_name, street_address, city, state, zip_code, 
										   phone_number, fax_number, business_logo, logo_location, affiliate_bs_id, date_created, web_site) 
										   VALUES 
										   (LAST_INSERT_ID()" .','. 
										   mysql_real_escape_string($_POST['b_contact']) .','.
										   mysql_real_escape_string($_POST['b_email']) .','.
										   mysql_real_escape_string($_POST['b_category']) .','.
										   mysql_real_escape_string($_POST['b_name'] .','.
										   mysql_real_escape_string($_POST['b_street']) .','.
										   mysql_real_escape_string($_POST['b_city']) .','. 
										   mysql_real_escape_string($_POST['b_state']) .','. 
										   mysql_real_escape_string($_POST['b_zip']) .','.
										   mysql_real_escape_string($_POST['b_phone']) .','.
										   mysql_real_escape_string($_POST['b_fax']) .','. 
										   mysql_real_escape_string($_POST['userfile']) .','.
										   "'Uploads', '1', $date" .','. 
										   mysql_real_escape_string($_POST['b_web_site']))
									 	 );

the problem is with $_POST['userfile'] when the query uploads, however I have found not examples for mysql_real_escape_string() on a INSERT so I am kind of guessing.

Thanks

Josh

coreyp_1

you are using the mysql_real_escape_string() correctly. It just helps protect your queries from being hacked.

what exactly is in the $POST['userfile'] variable? Is it a file your are uploading? if so, then you should be accessing the $FILES[] superglobal array.

homchz

It is a file, image to be exact.

First everything was uploading execept the image name I was hoping that I could grab the name to put in the db from $_POST.

However now I must have an error in the query as nothing updates even if I call $_FILES['userfile']['name']. The file uploads fine though so i know it is passing the info.

harmor

Try This

 mysql_query("INSERT INTO $this->ad_table (user_id, contact_name, business_email, catagory, business_name, street_address, city, state, zip_code,
                                           phone_number, fax_number, business_logo, logo_location, affiliate_bs_id, date_created, web_site)
                                           VALUES 
                                           (LAST_INSERT_ID()" .','. 
                                           mysql_real_escape_string($_POST['b_contact']) .','.
                                           mysql_real_escape_string($_POST['b_email']) .','.
                                           mysql_real_escape_string($_POST['b_category']) .','.
                                           mysql_real_escape_string($_POST['b_name'] .','.
                                           mysql_real_escape_string($_POST['b_street']) .','.
                                           mysql_real_escape_string($_POST['b_city']) .','. 
                                           mysql_real_escape_string($_POST['b_state']) .','. 
                                           mysql_real_escape_string($_POST['b_zip']) .','.
                                           mysql_real_escape_string($_POST['b_phone']) .','.
                                           mysql_real_escape_string($_POST['b_fax']) .','. 
                                           mysql_real_escape_string($_POST['userfile']) .','.
                                           "'Uploads', '1', $date" .','. 
                                           mysql_real_escape_string($_POST['b_web_site']))
                                          ) or die (mysql_error());

I added or die (mysql_error()); at the end.
This will return any errors your query may produce.

harmor

I edited you're query, hopefully there's no errors

mysql_query("INSERT INTO $this->ad_table (user_id, contact_name, business_email, catagory, business_name, street_address, city, state, zip_code,
                                           phone_number, fax_number, business_logo, logo_location, affiliate_bs_id, date_created, web_site)
                                           VALUES 
                                           ('LAST_INSERT_ID()',
                                           '".mysql_real_escape_string($_POST['b_contact']) ."',
                                           '".mysql_real_escape_string($_POST['b_email']) ."',
                                           '".mysql_real_escape_string($_POST['b_category']) ."',
                                           '".mysql_real_escape_string($_POST['b_name'] ."',
                                           '".mysql_real_escape_string($_POST['b_street']) ."',
                                           '".mysql_real_escape_string($_POST['b_city']) ."',
                                           '".mysql_real_escape_string($_POST['b_state']) .'",
                                           '".mysql_real_escape_string($_POST['b_zip']) ."',
                                           '".mysql_real_escape_string($_POST['b_phone']) ."',
                                           '".mysql_real_escape_string($_POST['b_fax']) ."', 
                                           '.mysql_real_escape_string($_POST['userfile']) ."',
                                           'Uploads', '1', '$date', 
                                           '".mysql_real_escape_string($_POST['b_web_site']))."'
                                          ) or die (mysql_error());

homchz

When I use the first query with the error I get this

You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '@greenwingassociates.com,Web Site Design,Greenwing Associates,5

it appears that spaces and symbols are killing the query? If I put a space in a name it give the same error right after the spaced name???

I noticed with your query that some of the "'s and ''s are reversed is this by design?

homchz

Resolved by sending the file name through the funtion I was calling.