[RESOLVED] T_ENCAPSED_AND_WHITESPACE Error

Moneyman2010mn

Hi, I'm somewhat new to php so here's my problem.

In the following code, I get this error "Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in /home/moneymen/public_html/test/index.php on line 15" but I don't understand what is wrong. I know this usually happens when someone is missing a quotation mark or switching between a single and double quote. Here's most of the code.

	$sql = "SELECT *
		FROM growable_buildings
		ORDER BY name ASC";
	$sql_result = mysql_query($sql, $connection) or die(mysql_error());
	echo "<table border='1'>";
	echo "<tr><th>Name</th><th>Type</th><th>Tileset</th><th>Stage</th><th>Capacity</th><th>Capacity at -$</th><th>Capacity at -$$</th><th>Bulldoze Cost</th><th>Power Consumed</th><th>Water Consumed</th></tr>";
	while ($row = mysql_fetch_array($sql_result))
	{
		echo "<tr><td>$row['name']</td><td>$row['type']</td><td>$row['stage']</td><td>$row['capacity_normal']</td><td>$row['capacity_$']</td><td>$row['capacity_$$']</td><td>$row['bulldoze_cost']</td><td>$row['power_consumed']</td><td>$row['water_consumed']</td><td>$row['pollution_garbage']</td></tr>";
	}

bradgrafelman

Arrays, more specifically items in arrays referenced by indeces, should not simply appear inside a double-quoted string. If they do, they should be wrapped in braces ( {} ). Instead, I usually escape out of the string and concatenate the array in the middle, like so:

echo 'Your name is: ' . $row['name'] . '! Hello there.';

Moneyman2010mn

Thanks, and I fixed the $ in capacity because that was also producing an error. 🙂

bradgrafelman

Don't forget to mark this thread resolved (if it is).

Moneyman2010mn

Actually I just thought of another question...

Let's say I have the exact form as the one on this page. This way users can manipulate the results of that page. If I were to use the GET method wouldn't that possibly make the page insecure because a hacker could enter something else for the value which will change and mess up the MySQL code? So would it be safer to use POST instead of GET? (By the way if you try the form, it doesn't work.)

Weedpacket

There's no security advantage in using POST over GET. Anyone with any intention of mounting an attack could just as easily forge a POST request as a GET request.

Never trust the client to send legitimate data.

And if this is another question, why isn't it another thread? People who are searching for information about their parse error won't need to see any of this stuff about form posting security, and people who are searching for information about form posting security aren't going to be interested in a parse error.

bradgrafelman

As always, Weedpacket is right on the money.

Both POST and GET allow "hackers" to input whatever data they want. You should be using functions such as [man]mysql_real_escape_string/man (or, at the very least, [man]addslashes/man) on incoming data before putting it anywhere near a SQL query string.

Moneyman2010mn

Thanks and thanks.

And I thought about posting a new thread but I decided not to as I saw many other people doing the same thing with no problems.

Weedpacket

They might not have had any problems, but there are several dozen thousand other people registered these forums. And who knows how many anonymous guests.