Mysql inserting php-snippet problem

exponder

I have a private db that I store personal data on. With a very basic skeleton script I can't seem to get certain scripts to pass through.

The problem mainly seems to be with scripts that use fopen, and fsockopen. But I've also had this problem with more complex scripts that don't use either of these.

I get two different errors depending on which script I'm trying to put into the database. The snippets I insert are later highlighted when they're dumped. One is "406 Not Acceptable", and the other is like there's an htaccess file keeping anyone from browsing the directory.

Here's the skeleton code I'm using to insert.

 <?php
  if ($action == add) {

  $dbh=mysql_connect ("localhost", "hoo", "boo")
  or die ('I cannot connect to the database because: ' . mysql_error());
            mysql_select_db ("sci");

        mysql_query("insert into articles (date, tag, topic, post, extra, public)values ('$date','$tag','$topic','$post','$extra','$public')") 
       or die("Could not add submission.");

       echo "Value Has been Entered<br /> Please return to the <a href=index.php> index </a>.";
 }
 ?>

Obviously I wouldn't have a problem if I highlighted them generically before inserting but I really don't want to go through all of that. I also don't have a problem inserting when I run a direct insert from mysql.

Anyone run into this problem/Understand why it's doing it. Or have a suggestion to fix it?

Rodney_H_

I am not sure what the specific problem is, however, I would definitely suggest that you escape the values/strings you insert into your DB.

Check this out: http://www.php.net/mysql_real_escape_string

bradgrafelman

As Rodney suggested, I would definitely run your variables through [man]mysql_real_escape_string/man before inserting them in a SQL query.

If that doesn't work... I too see nothing wrong with the "skeleton code" you posted, so you might need to post the actual code you're using that is giving you problems.

Also, if the mysql_query() call fails, don't just output an error message - output the query string itself as well as the contents of [man]mysql_error/man. The very first post in the Debugging 101 thread explains that buliding your SQL query string in a variable and then using that variable in your mysql_query() string allows you to easily echo the same query used in an "or die()" setup.