[RESOLVED] Unexpected $end

[Spine_Design]

<?php
	if(isset($_POST['confirm_delete'])){
	// make sure the the user really wants to delete this..
		// database connection
		global $conn;

	// Grab id from URL
	$bhid = $_REQUEST['bhid'];

	// SQL
	$q = "DELETE FROM `catalog`
		  WHERE `bh_id` = '$bhid'";  
	$result = mysql_query($q,$conn);

	if($result){ 
		// Query Success
		echo "item #".$bhid." was removed from the database."; 
	} 
	else 
	{ 
		// Query Fail
		echo "item #".$bhid." could not be removed at this time."; 
	}
} 
else 
{ 
// Form to confirm deletion
?>
		<form action="/admin/product-delete/<?=$bhid?>" method="post">
		<label for="confirm_delete">Are you sure you want to delete product #<?=$bhid?>? This action cannot be undone.</label>
		<input type="submit" name="confirm_delete" value="1" />
		</form>
<? 
	} 
?>

Parse error: syntax error, unexpected $end in index.inc.php(40) : eval()'d code on line 13

I just don't see it :quiet:

[bradgrafelman]

Considering that the code you posted a) doesn't even have 40 lines, and b) doesn't call eval(), I'm going to guess that you didn't post the contents of "index.inc.php" that the error message references.

[Spine_Design]

bradgrafelman;10911575 wrote:

Considering that the code you posted a) doesn't even have 40 lines, and b) doesn't call eval(), I'm going to guess that you didn't post the contents of "index.inc.php" that the error message references.

I posted the eval()'d code that the error references.

The code in index.inc.php is irrelevant in this case.

	if(mysql_num_rows($result) == 1){
		// Page content found
		$page_content = mysql_result($result,0,"page_content");
		echo eval("?>" . stripslashes($page_content) . "<?");
	}

Line 40 would be

echo eval("?>" . stripslashes($page_content) . "<?");

Which is eval()'ing the code I posted the first time.

[cahva]

Well if I understand correctly it states that there is error on evaled code on line 13 🙂

Parse error: syntax error, unexpected $end in index.inc.php(40) : [B]eval()'d code on line 13[/B]

If it is line 13, it must be referring to the sql query($q). I really dont use eval much so I dont know if there are limitations or something else because I dont see an error there also. Usually that error means that you have left out quote or something like that. And man, you are trusting $_REQUEST straight in your query. BAAAAD BOY! :glare:

Try to do the query different way(and a little bit safer):

$q = sprintf("DELETE FROM `catalog` WHERE `bh_id` = %d",
	mysql_real_escape_string($bhid)
);

(I'm quessing that bh_id is always numerical so I left out quotes and used %d in the sprintf)

[Spine_Design]

cahva;10911585 wrote:

Well if I understand correctly it states that there is error on evaled code on line 13 🙂

Parse error: syntax error, unexpected $end in index.inc.php(40) : [B]eval()'d code on line 13[/B]

If it is line 13, it must be referring to the sql query($q). I really dont use eval much so I dont know if there are limitations or something else because I dont see an error there also. Usually that error means that you have left out quote or something like that. And man, you are trusting $_REQUEST straight in your query. BAAAAD BOY! :glare:

Try to do the query different way(and a little bit safer):

$q = sprintf("DELETE FROM `catalog` WHERE `bh_id` = %d",
	mysql_real_escape_string($bhid)
);

(I'm quessing that bh_id is always numerical so I left out quotes and used %d in the sprintf)

well, you're right.. I was kind of just trying to make it work first before securing every XD.

I replaced the code.. and got the same error.

So frustrating.

[bradgrafelman]

Try replacing the '<?' tag with '<?php' in the eval() code you posted.

[Spine_Design]

bradgrafelman;10911594 wrote:

Try replacing the '<?' tag with '<?php' in the eval() code you posted.

New code:

<?php
	if(isset($_POST['confirm_delete'])){
	// make sure the the user really wants to delete this..
		// database connection
		global $conn;

	// Grab id from URL
	$bhid = $_REQUEST['bhid'];

	// SQL
	$q = sprintf("DELETE FROM `catalog` WHERE `bh_id` = %d",
		mysql_real_escape_string($bhid)
	); 
	$result = mysql_query($q,$conn);

	if($result){ 
		// Query Success
		echo "item #".$bhid." was removed from the database."; 
	} 
	else 
	{ 
		// Query Fail
		echo "item #".$bhid." could not be removed at this time."; 
	}
} 
else 
{ 
// Form to confirm deletion
?>
		<form action="/admin/product-delete/<?php echo $bhid; ?>" method="post">
		<label for="confirm_delete">Are you sure you want to delete product #<?php echo $bhid; ?>? This action cannot be undone.</label>
		<input type="submit" name="confirm_delete" value="1" />
		</form>
<?php 
	} 
?>

Same error:
Parse error: syntax error, unexpected $end in index.inc.php(40) : eval()'d code on line 13

My other pages all work fine.
*sigh

[Spine_Design]

cahva;10911585 wrote:

you are trusting $_REQUEST straight in your query. BAAAAD BOY! :glare:

That reminds me, I use .HTACCESS to accept only numbers for $bhid.

Yay for mod_rewrite and regex!

I knew I wasn't silly enough to make such a n00b mistake as sql injection.

[bradgrafelman]

Not sure what the problem is. Are you positive that the code snippet you're showing us above is the contents of $page_content? Out of curiosity, why are you using stripslashes() on data that comes from the DB?

Also, try changing the '<?' to '<?php' at the end of the eval() string.

[bradgrafelman]

Spine Design wrote:

That reminds me, I use .HTACCESS to accept only numbers for $bhid.

Why on earth would you try to prevent SQL injections in a .htaccess file? Besides, a rewrite rule would have no effect on POST'ed data, or data coming from a cookie or HTTP header. You still need to do SQL injection prevention in the code of your script.

[Spine_Design]

bradgrafelman;10911607 wrote:

Why on earth would you try to prevent SQL injections in a .htaccess file? Besides, a rewrite rule would have no effect on POST'ed data, or data coming from a cookie or HTTP header. You still need to do SQL injection prevention in the code of your script.

Sounds Scary.

But I'm only talking about using $_REQUEST.

I normally sanitize all $_POST data.

[bradgrafelman]

Spine Design wrote:

But I'm only talking about using $REQUEST.

So am I, since $REQUEST is basically just $GET, $POST and $_COOKIE all merged into one array.

[Spine_Design]

bradgrafelman;10911616 wrote:

So am I, since $REQUEST is basically just $GET, $POST and $COOKIE all merged into one array.

Oh really?

X____x;

By the way, I solved the problem.

Actually, for some reason there was a duplicate entry in my database that was missing the final closing bracket.

Haha.

I feel somewhat dumb.