What's wrong with this query?

[Azeem]

I keep getting the following error:

Parse error: syntax error, unexpected $end in /myhomage/PubslisherSignup.php on line 563

(Where line 563 is the last line in the document). I was able to comment out the following mysql query to get the page to load. So the problem is with the syntax in this query (I've been looking at it all day, and just don't see what the problem is):

$query = "INSERT INTO Man_PublishersAgreement (Website, Firstname, Lastname, email, email1, Street1, Street2, City, State, Zipcode, dayphone, Username, Password, Password1, paypal, spam_trap, terms, product, submit, MonthlyImpressions, Country, Description, Comments) VALUES ('{$POST[`Website']}', '{$POST['Firstname']}', '{$POST['Lastname']}', '{$POST['email']}', '{$POST['email1']}', '{$POST['Street1']}', '{$POST['Street2']}', '{$POST['City']}', '{$POST['State']}', '{$POST['Zipcode']}', '{$POST['dayphone']}', '{$POST['Username']}', '{$POST['Password']}', '{$POST['Password1']}', '{$POST['paypal']}', '{$POST['spam_trap']}', '{$POST['terms']}', '{$POST['product']}', '{$POST['submit']}', '{$POST['MonthlyImpressions']}', '{$POST['Country']}', '{$POST['Description']}', '{$_POST['Comments']}')";

Which is so weird, if I plug in the following code (from another form I did, I get no errors (which means syntactically it is correct):

$query = "INSERT INTO tbl_Conv_2007_Survey (name, email, source, organized, convenient, registration, onsitereg, onsiteregother, stay, hotel, bazaar, salah, food, babysitting, youthconference, children, expectations, benefitted, speakers, speakersDisagree, comments, suggestions, consideration, preregistration, parallel, women) VALUES ('{$POST['name']}', '{$POST['email']}', '{$POST['source']}', '{$POST['organized']}', '{$POST['convenient']}', '{$POST['registration']}', '{$POST['onsitereg']}', '{$POST['onsiteregother']}', '{$POST['stay']}', '{$POST['hotel']}', '{$POST['bazaar']}', '{$POST['salah']}', '{$POST['food']}', '{$POST['babysitting']}', '{$POST['youthconference']}', '{$POST['children']}', '{$POST['expectations']}', '{$POST['benefitted']}', '{$POST['speakers']}', '{$POST['speakersDisagree']}', '{$POST['comments']}', '{$POST['suggestions']}', '{$POST['consideration']}', '{$POST['preregistration']}','{$POST['parallel']}','{$POST['women']}')";

I do not see the difference between these two queries. Every parenthesis and curly bracket has a corresponding end element.

[tomhath]

Probably data related. Instead of executing the query, echo it out. Might be an extra quote or other special character that you haven't escaped.

[Weedpacket]

Look at this bit:

'{$_POST[`Website']}'

But that's what you get for writing such a spectacularly ugly and dangerous line (you do know that source code is supposed to be readable by humans, right?)

[bradgrafelman]

Also note that the code appears to be vulnerable to SQL injection attacks (or just accidental errors); user-supplied data should never be placed directly inside a SQL query. Instead, it should be sanitized with a function such as [man]mysql_real_escape_string/man (or via alternate means, such as PDO's automatic escape handling).

[Azeem]

Thanks guys, yeah I was going to get to validating the data. I was wondering if its a good idea to use Javascript to do that, so then I could use this code right. Or is that bad practice?

[bradgrafelman]

If you're doing form validation, you should do both. Relying solely on Javascript (or any client-side language), however, is never an acceptable practice since client-side scripting can easily be disabled and bypassed. It does, however, allow you to provide instant feedback to users filling out your form.

Whether you validate your data or not, however, just remember to run all user-supplied data through at least a DB-specific escaping function.