[RESOLVED] error, im not sure what it is!

Lsmooth

Its a simple submitting and inserting to database, and i get errors

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'by, date, story, source) VALUES ('PS3','testing is coming!','www.image.com','S' at line 1

This is my form:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>News</title>
<style type="text/css">
<!--
.style1 {
	font-size: 36px;
	font-weight: bold;
	color: #0099FF;
}
.style4 {font-size: 12px}
.style9 {color: #0099FF; font-weight: bold; }
.style10 {
	color: #FF0000;
	font-weight: bold;
}
-->
</style>
</head>

<body>
<table width="680" align="center">
  <tr>
    <td bgcolor="#CCCCCC"><div align="center"><span class="style1">News Submission</span></div></td>
  </tr>
  <tr>
    <td height="508" bgcolor="#F0F0F0"><form id="News" name="News" method="post" action="insert.php">

    <table width="100%" border="0" cellspacing="2">
      <tr>
        <td width="25%" valign="top"><span class="style9">News Type:</span></td>
        <td width="75%"><select type:"text" name="type">
          <option>Anime</option>
          <option>Dvd</option>
          <option>PS3</option>
          <option>Xbox 360</option>
          <option>Wii</option>
          <option>Pc</option>
          <option>Nintendo Ds</option>
          <option>PSP</option>
          <option>Movies</option>
          <option>Music</option>
          <option>Tv</option>
        </select></td>
      </tr>
      <tr>
        <td valign="top"><span class="style9">Title:</span></td>
        <td><label>
          <input type="text" name="title"/>
          <br />
          <span class="style4">Title Of the News Article</span>            </label></td>
      </tr>
      <tr>
        <td valign="top"><span class="style9">Image Url:</span></td>
        <td><input type="text" name="image"/></td>
      </tr>
      <tr>
        <td valign="top"><span class="style9">About:</span></td>
        <td><input type="text" name="about"/>
          <br />
          <span class="style4">(14 Words Max)</span></td>
      </tr>
      <tr>
        <td valign="top"><span class="style9">By:</span></td>
        <td><input type="text" name="by"/>
        <br />
        <span class="style4">Authurs Name ( Ex: John Doe)</span></td>
      </tr>
      <tr>
        <td valign="top"><span class="style9">Date:</span></td>
        <td><input type="text" name="date"/>
        <br />
        <span class="style4">Example: October 16, 1987</span></td>
      </tr>
      <tr>
        <td valign="top"><span class="style9">Story:</span></td>
        <td><label>
          <textarea name="story" id="story" cols="80" rows="15"></textarea>
        </label></td>
      </tr>
      <tr>
        <td valign="top"><span class="style9">Source:</span></td>
        <td><input type="text" name="source"/>
        <br />
        <span class="style4">If You Created this source and not from another site, insert &quot;TripleLevel&quot;</span></td>
      </tr>
      <tr>
        <td valign="top">&nbsp;</td>
        <td><label>
          <input type="submit" name="submit" id="submit" value="Submit" />
          <br />
          <span class="style10">Please Review ALL before Submitting!</span></label></td>
      </tr>
    </table>

  </form>
</td>
  </tr>
</table>
</body>

insert.php file that i use

<?php
$con = mysql_connect("","triplelvl","");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("triplelvl", $con);

$sql="INSERT INTO news (type, title, image, about, by, date, story, source)
VALUES
('$_POST[type]','$_POST[title]','$_POST[image]','$_POST[about]','$_POST[by]','$_POST[date]','$_POST[story]','$_POST[source]')";

if (!mysql_query($sql,$con))
  {
  die('TripleLevel Error: ' . mysql_error());
  }
echo "<center>News Artcle Submitted<br />
<a href='adminpanel/'>Go Back To Previous Page
</a></center>";

mysql_close($con)
?>

dzysyak

Try the following. I think you have used reserver words as a column names 😉


$sql="INSERT INTO news (`type`, `title`, `image`, `about`, `by`, `date`, `story`, `source`)
VALUES
('$_POST[type]','$_POST[title]','$_POST[image]','$_POST[about]','$_POST[by]','$_POST[date]','$_POST[story]','$_POST[source]')";

bradgrafelman

Some other things to note about your SQL query:

Array indeces in your case should be strings. $row[name] does not have a string as an index, but a constant. PHP will detect this (assuming there actually isn't a constant named 'name') and throw an E_NOTICE and then assume it is a string. So, use quotes: $row['name'].
Arrays, more specifically items in arrays referenced by indeces, should not simply appear inside a double-quoted string. If they do, they should be wrapped in braces ( {} ). Instead, I usually escape out of the string and concatenate the array in the middle, like so:
```
echo 'Your name is: ' . $row['name'] . '! Hello there.';
```
It appears as though you're vulnerable to SQL injection attacks. User-supplied data should never be placed directly into a SQL query! Instead, sanitize it with a function such as [man]mysql_real_escape_string/man.

Lsmooth

WOW im a noob, Thanks Guys!