[RESOLVED] Problem inserting into MYSQL database

patale

Hi Guys

First post, Can someone please help me with the following I keep getting a

Parse error: syntax error, unexpected T_CONSTANT_ENCAPSED_STRING in /home/caro/public_html/register/updatedb.php on line 15

(THE INSERT INTO LINE)

In the following code

<?php

include '../config/config.php';

$conn = mysql_connect($dbhost, $dbuser, $dbpass) or die ('Error connecting to mysql');
mysql_select_db($dbname, $conn);

$NameFR = $POST['name_from_req'];
$EmailF = $POST['email_from'];
$PostR = $POST['postcode_req'];
$FriendN = $POST['name_friend'];
$FriendE = $_POST['email_friend'];

$query = "INSERT INTO $dbname (name_from_req, email_from, postcode_req, name_friend, email_friend) VALUES ('".$NameFR"', '".$EmailF"', '".$PostR"', '".$FriendN"', '".$FriendE"')";

mysql_query($query) or die ('Error updating database');

echo "Database updated With: " .$NameFR. " ".$EmailF." ".$PostR." ".$FriendN." ".FriendE ;

mysql_close($conn);

// Close database
?>

Any help is greatly appreciated

Thanks
P.

laserlight

There is a repeated typographical error on this line:

$query = "INSERT INTO $dbname (name_from_req, email_from, postcode_req, name_friend, email_friend) VALUES ('".$NameFR"', '".$EmailF"', '".$PostR"', '".$FriendN"', '".$FriendE"')";

Notice that you did not concatenate the string literals correctly.

patale

Thanks for that but now im getting a different error

Parse error: syntax error, unexpected T_VARIABLE in /home/caro/public_html/register/updatedb.php on line 14

<?php

include '../config/config.php';

$conn = mysql_connect($dbhost, $dbuser, $dbpass) or die ('Error connecting to mysql');
mysql_select_db($dbname, $conn);

$NameFR = $POST['name_from_req'];
$EmailF = $POST['email_from'];
$PostR = $POST['postcode_req'];
$FriendN = $POST['name_friend'];
$FriendE = $_POST['email_friend'];

$query = "INSERT INTO $dbname (name_from_req, email_from, postcode_req, name_friend, email_friend) VALUES ('"$NameFR"', '"$EmailF"', '"$PostR"', '"$FriendN"', '"$FriendE"')";

mysql_query($query) or die ('Error updating database');

echo "Database updated With: " .$NameFR. " ".$EmailF." ".$PostR." ".$FriendN." ".FriendE ;

mysql_close($conn);

// Close database
?>

Any ideas?

NogDog

You need to use the "." concatenation operator:

$query = "INSERT INTO $dbname (name_from_req, email_from, postcode_req, name_friend, email_friend) 
VALUES ('" . $NameFR . "', '" . $EmailF . "', '" . $PostR . "', '" . $FriendN . "', '" . $FriendE . "')";

Personally, I find it easier to keep my sanity in such situations by using [man]sprintf/man:

$query = sprintf(
   "INSERT INTO %s (name_from_req, email_from, postcode_req, name_friend, email_friend)
   VALUES ('%s', '%s', '%s', '%s', '%s')",
   $dbname,
   $NameFR,
   $EmailF,
   $PostR,
   $FriendN,
   $FriendE
);

bradgrafelman

Also note that your code is vulnerable to SQL injection attacks (or even accidentally broken by the user); you should never place user-supplied data directly into a SQL query string. Instead you must first sanitize it with a function such as [man]mysql_real_escape_string/man.

patale

Thanks guys!! Much appreciated