[RESOLVED] Error...

zzz

I keep getting the following error

SQL/DB Error -- [You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'desc, offer, expiration, status) VALUES ('product', 'desc', ]

while trying to process:

INSERT INTO specials (product, desc, offer, expiration, status)
VALUES ('".$clean_product."', '".$clean_desc."', '".$clean_offer."', '".$_POST['orderdate']."', '".$_POST['status']."')

I've looked over and do not see anything that would cause this. Need an extra set of eyes to spot what I'm missing.

void_function

Save the query into a var and echo the var to see how it looks. From what you've presented, all seems ok, except maybe DESC is parsed as modifier, and not as field name? Try to enclose field names into single quotes:

INSERT INTO 'specials' ('product', 'desc', 'offer' ...

BTW, never put string $_POST vars directly into query, pass them through mysql_real_escape_string(), and if it contains strings that will be presented back to the user, clean it of HTML tags.

thorpe

desc is a reserved word in mysql and will need to be surrounded by backticks not single quotes.

void_function

Backticks.... ah, didn't know this. I always use tablename_fieldname exactly to avoid hitting a reserved word in some future implementation of the database.

ahundiak

void_function wrote:
Backticks.... ah, didn't know this. I always use tablename_fieldname exactly to avoid hitting a reserved word in some future implementation of the database.

Which works great unless you decide to change the name of the table. Or if the table name itself happens to be a reserved word.

The mysql manual has a list of it's reserved words.

zzz

Well, the server setup on this particular site is a bit picky. I never ran into any of these problems on my dedicated, but this one keeps choking. I ended up running an insert query on phpMyAdmin and copying it from tghere and then replacing the values with my own.

I saw backticks used before but never realized that's what I needed to use. I always used single quotes...

I also ended up including my vars like this: '$var12', 'var2' instead of '".$var12."', '".var2."'...
And I renamed desc to other name... Whatever I did it works now.

Thanks for all the great suggestions.

zzz

I'd like to see the list of the reserved words as well as the field size, i.e. how many chars can input be in each particular field type.

ClarkF1

http://dev.mysql.com/doc/refman/5.0/en/reserved-words.html

http://dev.mysql.com/doc/refman/5.0/en/data-types.html