yet another mysql insert error see if everything looks right

[dugindog]

I've been looking at this for over an hour, please look over and see if you see any errors.

mysql_query("INSERT INTO `pg_pages` (`user`,`name`,`keywords`,`description`,`title`,`body`) VALUES( `$foldername`, `$data[0]`, `$data[1]`, `$data[2]`, `$data[3]`, `$data[4]` )") or die(mysql_error());  

here's the output I'm getting:

connected

Unknown column 'emaildomaincom' in 'field list'

the table setup up very simple

# CREATE statement for pg_pages
CREATE TABLE `pg_pages` (
  `user` tinytext NOT NULL,
  `name` tinytext NOT NULL,
  `keywords` text,
  `description` text NOT NULL,
  `title` tinytext NOT NULL,
  `body` longtext NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=latin1

and heres the "majority of the code"

foreach( $page as $key => $value){
	/*echo "Name: $key, Age: $value <br />";*/

$data = explode("----",$value);
$menuname[$key] = $data[0];
$data[0] = str_replace(" ", "",$data[0]) ;
$data[0] = chop($data[0]) . $exttype;
$menulink[$key] = $data[0];
$menuitem .= "<li><a href='" . $menulink[$key] . "'>" . $menuname[$key] . "</a></li>";
$keywords[$key] =  trim($data[1]);
$description[$key] = trim($data[2]);
$title[$key] = trim($data[3]);


// Set up the body text of the page

$data[4] = nl2br($data[4]);
$data[4] = str_replace("[LINK]","<a href =  '", $data[4]);
$data[4] = str_replace('[URL="','', $data[4]);
$data[4] = str_replace("\"]","'>", $data[4]);
$data[4] = str_replace("[ENDLINK]","</a>", $data[4]);
$data[4] = str_replace("[BOLD]","<b>", $data[4]);
$data[4] = str_replace("[ENDBOLD]","</b>", $data[4]);
$data[4] = str_replace("[CENTER]","<center>", $data[4]);
$data[4] = str_replace("[ENDCENTER]","</center>", $data[4]);
$data[4] = str_replace("[ITALIC]","<i>", $data[4]);
$data[4] = str_replace("[ENDITALIC]","</i>", $data[4]);

$bdy = $body[$key] =  addslashes($data[4]);

//echo "'$user'" . "'" . $data[0] . "'" .  "'" . $data[1] . "'" .  "'" . $data[2] . "'" .  "'" . $data[3] . "'" .  "'" . $data[4]."'";


//insert into database
/*$query = "INSERT INTO `pg_pages` (`user`,`name`,`keywords`,`description`,`title`,`body`) VALUES( `$foldername`, `$data[0]`, `$data[1]`, `$data[2]`, `$data[3]`, `$data[4]` ) ";



echo $query;*/

mysql_query("INSERT INTO `pg_pages` (`user`,`name`,`keywords`,`description`,`title`,`body`) VALUES( `$foldername`, `$data[0]`, `$data[1]`, `$data[2]`, `$data[3]`, `$data[4]` )") or die(mysql_error());  

?>
<?
}

help please, also if you see other issues, please let me know

[bubblenut]

What's in the $query variable? ie. after the other variables have been added in. The error doesn't look like it comes from the query you've provided.

[Piranha]

For values you should use ' signs (or " signs) and not backticks. For table and column names it is correct what you do, useing backticks.

[dugindog]

Piranha wrote:

For values you should use ' signs (or " signs) and not backticks. For table and column names it is correct what you do, useing backticks.

have changed the query to:

mysql_query("INSERT INTO `pg_pages` (`user`,`name`,`keywords`,`description`,`title`,`body`) VALUES( '$foldername', '$data[0]', '$data[1]', '$data[2]', '$data[3]', '$data[4]' )") or die(mysql_error());  

the result is:

connected

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'HTTP://WWW.GOOGLE.COM'>THE TEXT WITHIN THE LINK

Testing B' at line 1

[dugindog]

the query works fine, however the problem is in the escaping of the characters in in the variables.

could you look thru it, and make sure that I'm doing it right?

again here's the code:

here's the html output:

connected


--------------------------------------------------------------------------------

Welcome to our home page.
this is an example.

LINK:

THE TEXT WITHIN THE LINK

Testing Bold 

Testing Center

Testing Italic 

--------------------------------------------------------------------------------
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'HTTP://WWW.GOOGLE.COM'>THE TEXT WITHIN THE LINK

Tes' at line 1

here's the html output source:

connected<BR><BR><HR> <br />
Welcome to our home page.<br />
this is an example.<br />
<br />
LINK:<br />
<br />
<a href =  \'"HTTP://WWW.GOOGLE.COM\'>THE TEXT WITHIN THE LINK</a><br />
<br />
<b> Testing Bold </b><br />
<center> Testing Center</center><br />
<i> Testing Italic </i><br />
 <HR>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'HTTP://WWW.GOOGLE.COM'>THE TEXT WITHIN THE LINK</a><br />
<br />
<b> Tes' at line 1

Here's the PHP source:

<?
include('vars.php');
include('connect.php');

$email = $_REQUEST[email];
$foldername = str_replace('@','',$email);
$foldername = str_replace('.','',$foldername);
$exttype = $_REQUEST[extension];

if (@mkdir("/home/goremote/public_html/fileupload/uploads/$foldername",0777)) {/*echo "folder create successful<BR><BR>";*/}
if (@chmod("/home/goremote/public_html/fileupload/uploads/$foldername",0777)) {/*echo "permissions chance successful<BR><BR>";*/}

$footer = "This is the footer.  &copy2007 <a href='http://www.servers-n-systems.com' target='sernsys'>Servers-n-Systems.com</a>";
$basepath = "/home/goremote/public_html/fileupload/uploads/$foldername/". $_FILES['uploadedfile']['name'];
$orig_path = "/home/goremote/public_html/fileupload/uploads/$foldername/";
$urlpath = "http://www.go-remote.com/fileupload/uploads/$foldername/";
$target_path = $target_path . basename( $_FILES['uploadedfile']['name']); 

if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $basepath )) {
    } else{
    die("There was an error uploading the file, please try again!<BR><BR><a href='index.php'>Click here </a> to try again.");
}
$total = basename( $_FILES['uploadedfile']['name']);
$content = $_FILES['content']['name'];
$test = file_get_contents($basepath );
$t2 = trim($test);
$page = explode("====",$t2);

// foreach loop insert to database


// Insert a row of information into the table "example"

$menuitem = "";
foreach( $page as $key => $value){
	/*echo "Name: $key, Age: $value <br />";*/

$data = explode("----",$value);
$menuname[$key] = addslashes($data[0]);
$data[0] = str_replace(" ", "",$data[0]) ;
$data[0] = chop($data[0]) . $exttype;
$menulink[$key] = addslashes($data[0]);
$menuitem .= "<li><a href='" . $menulink[$key] . "'>" . $menuname[$key] . "</a></li>";
$keywords[$key] =  addslashes(trim($data[1]));
$description[$key] = addslashes(trim($data[2]));
$title[$key] = addslashes(trim($data[3]));


// Set up the body text of the page

$data[4] = nl2br($data[4]);
$data[4] = str_replace("[LINK]","<a href =  '", $data[4]);
$data[4] = str_replace('[URL=\"','', $data[4]);
$data[4] = str_replace("\"]","'>", $data[4]);
$data[4] = str_replace("[ENDLINK]","</a>", $data[4]);
$data[4] = str_replace("[BOLD]","<b>", $data[4]);
$data[4] = str_replace("[ENDBOLD]","</b>", $data[4]);
$data[4] = str_replace("[CENTER]","<center>", $data[4]);
$data[4] = str_replace("[ENDCENTER]","</center>", $data[4]);
$data[4] = str_replace("[ITALIC]","<i>", $data[4]);
$data[4] = str_replace("[ENDITALIC]","</i>", $data[4]);

$data[4] = str_replace("\\\\", "\\", $data[4]);
$bdy = $body[$key] =  addslashes($data[4]);

echo "<HR> $bdy <HR>";

//echo "'$user'" . "'" . $data[0] . "'" .  "'" . $data[1] . "'" .  "'" . $data[2] . "'" .  "'" . $data[3] . "'" .  "'" . $data[4]."'";


//insert into database
/*$query = "INSERT INTO `pg_pages` (`user`,`name`,`keywords`,`description`,`title`,`body`) VALUES( `$foldername`, `$data[0]`, `$data[1]`, `$data[2]`, `$data[3]`, `$data[4]` ) ";



echo $query;*/

mysql_query("INSERT INTO `pg_pages` (`user`,`name`,`keywords`,`description`,`title`,`body`) VALUES( '$foldername', '$data[0]', '$data[1]', '$data[2]', '$data[3]', '$data[4]' )") or die(mysql_error());  

?>
<?
}
mysql_close();
?>

[Piranha]

Don't use addslashes. Use the function for the correct database instead, with mysql it is [man]mysql_real_escape_string[/man].

[bradgrafelman]

Few things:

1. You shouldn't use the '<?' short tags for portability's sake, as well as the fact that they are deprecated and no longer available as of PHP6.

2. Arrays, more specifically items in arrays referenced by indeces, should not simply appear inside a double-quoted string. If they do, they should be wrapped in braces ( {} ). Instead, I usually escape out of the string and concatenate the array in the middle, like so:

   echo 'Your name is: ' . $row['name'] . '! Hello there.';

3. All variables that contain user-supplied data should be sanitized (with a function such as [man]mysql_real_escape_string/man before they are used in a query string.

[Weedpacket]

And if you were using the PDO interface, the database driver would automatically do whatever escaping is appropriate/necessary.