[RESOLVED] Help with INSERT and textarea

earthaflame

I'm a newbie to PHP, but this is a coding problem, so I don't know if I should post here or not, but I seem to have a problem inserting a textarea value into my table, I can't seem to figure out why it doesn't work. Here is my script

$ministry = $POST["textfield"];
$desc = $POST["textarea"];
$base = $_COOKIE["base"];
$sql = "SELECT * FROM ministry WHERE base = '$base' AND ministry = '$ministry'";
mysql_connect($host,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");
IF (mysql_num_rows(mysql_query($sql))) {echo "Sorry, '$ministry' already exists for '$base'. Please enter a different ministry or change to a different base."; }else {
$add = "INSERT INTO ministry (base, ministry) VALUES ('$base', '$ministry')";
$add2 = "INSERT INTO ministry (desc) VALUES ('$desc')";
mysql_query($add) or die(mysql_error());
mysql_query($add2) or die(mysql_error());
$minnew = mysql_fetch_assoc(mysql_query($sql));
echo "Base: $minnew[base] Ministry: $minnew[ministry]";}
?>

$add used to be one query but I seperated it to try to find the problem. When it runs, the second query fails and I get the following error message:

You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'desc) VALUES ('Feed')' at line 1

Thanks in advance for your help

Houdini

Could be that in the variable $desc there are apostophes or single quotes you should use $desc=addslashes($desc) before you try to insert data that someone else put into the textarea.
Notice in the error instead of showing $desc it shows Feed there is probably a single quote after Feed as in Feed's

bradgrafelman

I'm really tempted to agree with Houdini, but it shows the ending ) after Feed...

I don't remember if MySQL debugging is in the Debugging 101 thread, but you might try visiting it (the link is in my sig). In the mean time, echo out the varible with the MySQL query and visually inspect it. Does it look right? Post it here for us.

earthaflame

I tried addslashes, but no change, I also added an echo statement using 'test' (without single quotes) for the input. Here is the updated output.

testYou have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'desc) VALUES ('test')' at line 1

slashes did not show up in the echo, should they have? The $desc=addslashes($desc); is before the echo.

Thanks for your help.

bradgrafelman

bradgrafelman wrote:
... echo out the varible with the MySQL query and visually inspect it. Does it look right? Post it here for us.

earthaflame

Here is my updated code with echos as well as the updated output. 'test' is the value I passed into $desc.

$ministry = $POST["textfield"];
$desc = $POST["textarea"];

$base = $_COOKIE["base"];
$sql = "SELECT * FROM ministry WHERE base = '$base' AND ministry = '$ministry'";
$desc= addslashes($desc);

mysql_connect($host,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");
IF (mysql_num_rows(mysql_query($sql))) {echo "Sorry, '$ministry' already exists for '$base'. Please enter a different ministry or change to a different base."; }else {
$add = "INSERT INTO ministry (base, ministry) VALUES ('$base', '$ministry')";
$add2 = "INSERT INTO ministry (desc) VALUES ('$desc')";
echo $add2;
echo $desc;

mysql_query($add) or die(mysql_error());
mysql_query($add2) or die(mysql_error());
$minnew = mysql_fetch_assoc(mysql_query($sql));
echo "Base: $minnew[base] Ministry: $minnew[ministry]";}
?>

INSERT INTO ministry (desc) VALUES ('test')testYou have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'desc) VALUES ('test')' at line 1

earthaflame

I thought of something, my desc column is a text type while my other columns are varchar. I thought text would be most appropriate, but is there some issue with inputing into a text type column?

earthaflame

I fixed it!, thanks to everyone for your help, the problem was I need the marks around my desc column so now my INSERT statement looks like $add2 = "INSERT INTO ministry (desc`) VALUES ('$desc')";
I don't know why it wasn't an issue for the other columns, but hey, it works now so I am happy.

bradgrafelman

D'oh! So sorry I didn't catch that!

DESC is a keyword in MySQL, meaning descending, as in "ORDER BY id DESC". When it saw desc without the backticks (`), it thought you were referring to this keyword. Obviously, you wanted to give it a column name, so it errored out.

As a practice, I've always used backticks around database and table names in my MySQL queries, that way there's no chance that any of my columns' names will conflict with MySQL keywords, even in future versions.