selecting content from database error??

[josh22x]

Ok, first of all I am a newby to this PHP stuff, so give me some slack...

I am attaching my form and the PHP script. The script keeps locking on the select statement and returning:

Parse error: syntax error, unexpected T_STRING in /var/www/html/PHP_blog/processing1.php on line 79

No matter what else I change in the script (even if I miss-type a function intentionally), it always returns this same error. Could you tell/show me what I am doing wrong?? Thanks!

<form action="processing1.php" method="post">

<fieldset class = "fieldset1">
<legend class = "legend">Name and Details</legend>

<dt class = "dt">First Name:</dt>

<dd><input class = "text_area" type="text" name="name" maxlength="20" size="20"></dd>

<dt class = "dt">Last Name:</dt>

<dd class = "dd"><input class = "text_area" type="text" name="last" maxlength="20" size="20"></dd>

<dt class = "dt">Email:</dt>

<dd><input class = "text_area" type="text" name="email" maxlength="20" size="20"></dd>

</fieldset>
</div>

Script::

<?php

// Report all PHP errors
//error_reporting(E_STRICT);

function error_display()
{
	die("Error " . mysql_errno() . " : " . mysql_error());
}

  $name=$_POST['name'];
  $email=$_POST['email'];
  $comments=$_POST['comments'];

  if (!$name || !$email || !$comments)
  {
    error_display();
  }
  if (get_magic_quotes_gpc())
  {
    $name = stripslashes($name);
    $last = stripslashes($last);
    $email = stripslashes($email);
    $comments = stripslashes($comments);
  }

 sql_connect('localhost', 'josh', 'josh', 'blog');

  $query = ("insert into content values '', '".$name."', '".$email."', '".$comments."', 

  mysql_real_escape_string($name),  mysql_real_escape_string($email),
  mysql_real_escape_string ($comments)); 

  $result = mysql_query($query, $data);

  if (mysqli_connect_errno($data)) 
  {
     echo 'Error: Could not connect to database.  Please try again later.';
     exit;
  }

$result1 = "SELECT * FROM blog";

if mysql_error($data)
      echo 'Error with the query';
}


$row = mysql_fetch_assoc($result1);

while($row = mysql_fetch_assoc($result1))

echo "The {$row["name"]} their email is {$row["email"]}".
echo "Their comment was {$row["blog"]}.\n";

?>

Thanks so much for your help!!

[big_nerd]

First and foremost you have an unclosed quote in your query statement.

<?php 

// Report all PHP errors 
//error_reporting(E_STRICT); 

function error_display() 
{ 
    die("Error " . mysql_errno() . " : " . mysql_error()); 
} 

  $name=$_POST['name']; 
  $email=$_POST['email']; 
  $comments=$_POST['comments']; 

  if (!$name || !$email || !$comments) 
  { 
    error_display(); 
  } 
  if (get_magic_quotes_gpc()) 
  { 
    $name = stripslashes($name); 
    $last = stripslashes($last); 
    $email = stripslashes($email); 
    $comments = stripslashes($comments); 
  } 

sql_connect('localhost', 'josh', 'josh', 'blog'); 

  $query = ("insert into content values '', '".$name."', '".$email."', '".$comments."', '".   

  mysql_real_escape_string($name)."', '".mysql_real_escape_string($email)."', '".
  mysql_real_escape_string ($comments)."'"); 

  $result = mysql_query($query, $data); 

  if (mysqli_connect_errno($data)) 
  { 
     echo 'Error: Could not connect to database.  Please try again later.'; 
     exit; 
  } 

$result1 = "SELECT * FROM blog"; 

if mysql_error($data) 
      echo 'Error with the query'; 
} 


$row = mysql_fetch_assoc($result1); 

while($row = mysql_fetch_assoc($result1)) 

echo "The {$row["name"]} their email is {$row["email"]}". 
echo "Their comment was {$row["blog"]}.n"; 

?> 

You had function names within the quotes, which PHP will take as a string.

And if I am not mistaken, you still need to add the "single quote" around mysql_real_escape_string.

You can see the PHP Manual, look at the post by Tim Furry. He has a nice function that will add quotes; etc.

Good Luck

[cahva]

Well that query doesnt make sense at all. It has $name, $email and $comments twice. Once without mysql_real_escape_string and once with..

I don't know the database structure but you are inserting the content without field names and it tells me that either you have no id(which you should always have) or the id field is not at the beginning.

Anyway, this should work:

$query = sprintf("insert into content values ('%s','%s','%s')",
		mysql_real_escape_string($name),
		mysql_real_escape_string($email),
		mysql_real_escape_string($comments));

IF you have id field as the first one, you should define the fields also in your insert:

$query = sprintf("insert into content (name,email,comment) values ('%s','%s','%s')",
		mysql_real_escape_string($name),
		mysql_real_escape_string($email),
		mysql_real_escape_string($comments));