[RESOLVED] delte all then add to sql

dvwhi

hi i need a to delete all the contents of a table in my sql and insert a new thing into that table here is my try at it

<?php
include("database.php");

$mum="DELETE * FROM bignews ";
if (!mysql_query($mum))
  {
  die('Error: ' . mysql_error());
  }else{
$sql="INSERT INTO bignews (`news`, `date`, `name`, `itemname` `id`)
VALUES
('$_POST[news]','$_POST[date]','$_POST[name]','$_POST[item]','1')";
if (!mysql_query($sql))
  {
  die('Error: ' . mysql_error());
  }
}


?>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<title>Redirecting...</title>

<meta http-equiv="REFRESH" content="0;url=index.html"></HEAD>
<body>

</body>
</HTML>

the sql is on the include("database.php");

bradgrafelman

Well, other than the fact that your script is vulnerable to MySQL injection attacks (or simply SQL query errors depending upon what the user enters), I don't immediately notice any problems.

What's the problem? You told us what you expected to happen, but you didn't tell us what is happening instead? Do you have error_reporting set to E_ALL and, if so, are there any error messages?

dvwhi

when i enter the form then submit it , it comes up with this Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'id) VALUES ('hi im bored','15th Febuary 2009','Dom Richardson','Test 1','1')' at line 1

bradgrafelman

Missing comma between the last two column names in your query.

Also, as I mentioned before, your script is vulnerable to SQL injection attacks. User-supplied data should never be placed directly into a SQL query. Instead, it should first be sanitized with a function such as [man]mysql_real_escape_string/man.

Weedpacket

In relation to what bradgrafelman said about SQL injection... what would have happened if you wrote

hi im bored

using proper English grammar?

Weedpacket

In relation to what bradgrafelman said about SQL injection... what would have happened if you wrote

hi im bored

using proper English grammar?