multiple $_POST problem.

sebatm

hi,

i want to write to an table some information from a form but keep getting an SQL error to check the syntax.

I really can'y figure it out.

can someone help?

 echo "<table width='450'><tr><td  width='150'>Utilitate</td><td width='150'>Pret ( Separatorul zecimal este -punct-)</td><td width='150'>Data aplicarii (In forma AAAA-LL-ZZ)</td></tr></table>";
       echo "<form method='post'>";  

       echo " <table width='450'>
            <tr>
                    <td width='150'> Apa Rece:</td>
                    <td width='150'><input type='text' name='pret' align='center' size='10' maxlength='5'></td>";
                       $pret=$_POST['pret'];
                   echo" <td width='150'> <input type='text' name='data' align='center' size='12' maxlength='10'> </td>
            </tr> </table> 
            <input type='submit' value='Modifica'>";
            $data=$_POST['data'];
            echo "</form>";
            $insert= "INSERT INTO pret_apa_rece(pret, data) VALUES (".$pret.",".$data. ")";
                if (!mysql_query($insert,$con)){
                      die('Error: ' . mysql_error());
                  }

            echo "<br>Inregistrare adaugata!";

break;

sebatm

i've also tried to insert in the query instead of $pret and $data, $_POST['pret'] same with data.

same error:
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ')' at line 1

Pragz

Try this:

 echo "<table width=\'450\'><tr><td  width=\'150\'>Utilitate</td><td width=\'150\'>Pret ( Separatorul zecimal este -punct-)</td><td width=\'150\'>Data aplicarii (In forma AAAA-LL-ZZ)</td></tr></table>";
       echo "<form method=\'post\'>";  

       echo " <table width=\'450\'>
            <tr>
                    <td width=\'150\'> Apa Rece:</td>
                    <td width=\'150\'><input type=\'text\' name=\'pret\' align=\'center\' size=\'10\' maxlength=\'5\'></td>";
                       $pret=$_POST['pret'];
                   echo" <td width=\'150\'> <input type=\'text\' name=\'data\' align=\'center\' size=\'12\' maxlength=\'10\'> </td>
            </tr> </table> 
            <input type=\'submit\' value=\'Modifica\'>";
            $data=$_POST['data'];
            echo "</form>";
            $insert= "INSERT INTO pret_apa_rece(pret, data) VALUES (" . $pret . "," . $data . ")";
                if (!mysql_query($insert,$con)){
                      die('Error: ' . mysql_error());
                  }

            echo "<br>Inregistrare adaugata!";

break;

sebatm

what's with the backslashes?

Pragz

Apostrophes and quote tags have to have a backslash before them, otherwise it'll give errors.

bradgrafelman

Pragz;10953418 wrote:
Apostrophes and quote tags have to have a backslash before them, otherwise it'll give errors.

Er... no they don't; you only have to escape single quotes if they are used as the string delimiter (which they aren't). Plus, an unescaped quote would cause a parse error, not a SQL error.

@: String values in SQL queries must be surrounded with quotes - just like they do in PHP. Also, note that user-supplied data should never be placed directly into a SQL query else your script will be vulnerable to SQL injection attacks and/or just plain SQL errors. Instead, you must first sanitize the data with a function such as [man]mysql_real_escape_string/man (for string data).