INSERT error

[messels]

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'show, link) VALUES ('*','','***')' at line 1

i've only built one ohter insert form before; this is my second site.

PHP Code:

if (isset($POST['submit']))
{
include "database.inc.php";
$site = $POST['site'];
$link= $_POST['link'];
$int_insert = "SELECT * FROM links";
$int_result = mysql_query($int_insert);

if ($int_insert)
{
$insert = "INSERT INTO links (site, link) VALUES ('$site','$link')";
$insert_query = mysql_query ($insert);

	if ($insert_query)
	{echo "site and link inserted in database.  go get another one!!  :)"; }

	if (!$insert_query)
	{echo mysql_error(); }

}
elseif (!$int_results)
{echo mysql_error(); }

mysql_close ();
}

[messels]

touched it up a little. including the form this time.

Code:

<?php
if (isset($POST['submit']))
{
include "database.inc.php";
print_r ($POST);
echo "<br /><br />";
$site = $POST['site'];
$link= $POST['link'];

$insert = "INSERT INTO links (site, link)
		 VALUES ('$site','$link')";
$insert_query = mysql_query ($insert);

	if ($insert_query)
	{echo "site and link inserted in database.  go get another one!!  :)"; }

	if (!$insert_query)
	{echo mysql_error(); }

elseif (!$int_results)
{echo mysql_error(); }

mysql_close ();
}

?>
input show information here: <br />

<form action="#" method="post">

Netowrk
<input type="text" name="site" value="" />

URL
<input type="text" name="link" value="" />
<input type="submit" name="submit" value="submit" />
</form>

<a href="home.php"> home</a>

</body>
</html>

[dagon]

run mysql_real_escape_string() on both $site and $link before inserting them

[messels]

dagon wrote:

run mysql_real_escape_string() on both $site and $link before inserting them

hmm, still not working.
got: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use...at line 1

used:
if (isset($POST['submit']))
{
include "database.inc.php";
print_r ($POST);
echo "<br /><br />";
$site = $POST['site'];
$link= $POST['link'];
mysql_real_escape_string ($site);
mysql_real_escape_string ($link);
$insert = "INSERT INTO links (site, link)
VALUES ('$site','$link')";
$insert_query = mysql_query ($insert);

	if ($insert_query)
	{echo "site and link inserted in database.  go get another one!!  :)"; }

	if (!$insert_query)
	{echo mysql_error(); }

any ideas??

[laserlight]

Instead of:

$site = $_POST['site'];
$link= $_POST['link'];
mysql_real_escape_string ($site);
mysql_real_escape_string ($link);

write:

$site = mysql_real_escape_string($_POST['site']);
$link = mysql_real_escape_string($_POST['link']);

[messels]

interesting. and thanks.
i actually had fixed the whole "mysql_real_escape_string();" to read as you suggested but it wasn't working for only one of the variables. it was something weird. i just renamed one of hte fields and it worked.

on that though, does using
$link = mysql_real_escape_string ($link);
keep the backslashes from an http in? as well as the colon (🙂 ?

should i be truncating those out? is it better to use javascript to pull those characters out and then include them in output (so : print ("<a href=\"http://$link\"> click here </a>");

?

thanks for your help thus far. 🙂

[messels]

that first simily is suppose to be a : by itself. doh.

[laserlight]

on that though, does using
$link = mysql_real_escape_string ($link);
keep the backslashes from an http in? as well as the colon

Eh, but there are no backslashes in "http://" 😉

Anyway, any backslashes, if present, will be escaped as well, so they will be retained.