[RESOLVED] Error in MySQL Syntax?

rsmith

Maybe I'm blind but I get an error in MySQL Syntax message for the following code:

<?
	//Get the form variables
		$recipient = $_POST['recipient'];
		$from = $_POST['from'];
		$sent = $_POST['sent'];
		$message = $_POST['message'];

//Insert the message into the database for the recipient
	$query = "INSERT INTO messaging SET
										recipient = '".$recipient."',
										from = '".$from."',
										sent = '".$sent."',
										msg = '".$message."'";

	$result = mysql_query($query);

	print mysql_error();

//Redirect back to send message form
//	header("Location: message-add.php");
?>

It says to look for the right code to use near from = '".$from."', sent='".$sent."',

I can't see any issues. Any ideas?

bradgrafelman

You're not santizing the data... not only are you vulnerable to SQL injection attacks, but certain data can also break your query. I would pass the POST'ed data through a function like [man]mysql_real_escape_string/man before you put it in a query. For more information, Google or search the board for "SQL injection".
I don't see any debug steps taken... try echo'ing out the contents of [man]mysql_error/man as well as echo'ing the $query itself (to see what's actually being sent to the SQL server) and post the output for us to see.

rsmith

I have several queries in my website the function this exact same way and none of them are broken or give any errors.

When I echoed the query to see what was being inserted I get the following

INSERT INTO messaging SET recipient = 'testuser', from = 'Test User', sent = 'December 31st 2006 02:04:41 PM', msg = 'Test Message'

bradgrafelman

rsmith wrote:
I have several queries in my website the function this exact same way and none of them are broken or give any errors.

That may be true, but depending upon whether or not magic_quotes_gpc is enabled (a configuration which can change if the host upgrades php, changes to the php config, switch hosts, etc.) you still have queries that are possibly vulnerable to exploit or error.

Secondly, 'from' is a keyword in SQL, so if you've used it as a column name you need to identify it as such. This is why I always surround table names and column names with backticks ( ) in my queries, like so: [code]SELECTcolumn1,column2FROMmyTable`[/code]

rsmith

Thanks got it! It was the fact that I was using a table row called "from" without escaping it. MySQL was having fits with that. Thanks for all the help!