need help pls >:( Thanks for your time

[heiiumzz]

Hi guys have been facing this error, tried to solve it for hours but of no use. :queasy:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ' , nice, , 1 room, )' at line 10

Codes:

<?php
	session_start();
	$userID = $_SESSION['user_id'];
	if(isset($_POST)){
		$propertyType= $_POST['propertyType'];
		$userID = $_POST['user_ID'];
		$itemDescription = $_POST['itemDescription'];
		$itemPrice = $_POST['Price'];
		$itemAge = $_POST['itemAge'];
		$Purpose = $_POST ['purpose']; 

	$HOST = 'localhost';
	$USERNAME = 'root';
	$PASSWORD = '';
	$DB = 'fyp';

	$link = mysqli_connect($HOST,$USERNAME,$PASSWORD,$DB) or die (mysqli_connect_error());
    $sql = "INSERT INTO sale_items (
	propertyType,
	user_id,
	itemDescription,
	Price,
	itemAge,
	purpose

	) VALUES (
	".$propertyType.",
	".$userID.",
	".$itemDescription.",
	".$Price.",
	".$itemAge.",
	".$Purpose.")";
	$status = mysqli_query($link,$sql) or die(mysqli_error($link));



	if($status){
		$message = "Item posted successfully.<br />";
		$message .= "<a href='index.php'>Home</a>";
	}else{
		$message = "Item post failed.<br />";
		$message .= "<a href='postSaleItem.html'>Try Again.</a>";
	}
}else{
	$message = "All item details have to be provided.<br />";
	$message .= "<a href='postSaleItem.html'>Try Again.</a>";

}
?>

Thanks for ur help again..

[dagon]

the values need to be quoted

[heiiumzz]

sorry for being a newbie, but what do u mean by quoting? thanks for ur time.

[Crowly]

All text fields must be within a pair of ' (quotes)
I presume itemDescription and purpose are text fields (char/varchar etc)

$sql = "INSERT INTO sale_items (
propertyType,
user_id,
itemDescription,
Price,
itemAge,
purpose

) VALUES (
".$propertyType.",
".$userID.",
'".$itemDescription."',
".$Price.",
".$itemAge.",
'".$Purpose."')";

Or do to it with sprintf(), note the ' around %s

$sql = sprintf("INSERT INTO sale_items (
propertyType,
user_id,
itemDescription,
Price,
itemAge,
purpose
) VALUES (%d,%d,'%s',%d,%d,'%s')",
$propertyType,$userID,$itemDescription,
$Price,$itemAge,$Purpose);

[heiiumzz]

I changed my codes with the quotes that u sir mentioned, but still facing error.

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ') VALUES ( , , 'An large and cozy place suitable f' at line 10

This is how my codes look like after the change.

<?php
	session_start();
	$userID = $_SESSION['user_id'];
	if(isset($_POST)){
	    $userID = $_POST['user_ID'];
		$propertyType= $_POST['propertyType'];
		$itemDescription = $_POST['itemDescription'];
		$itemPrice = $_POST['Price'];
		$Purpose = $_POST ['purpose'];
		$itemAge = $_POST['itemAge'];



	$HOST = 'localhost';
	$USERNAME = 'root';
	$PASSWORD = '';
	$DB = 'fyp';

	$link = mysqli_connect($HOST,$USERNAME,$PASSWORD,$DB) or die (mysqli_connect_error());
    $sql = "INSERT INTO sale_items (
	`user_id`,
	`propertyType`,
	`itemDescription`,
	`Price`,
	`purpose`,
	`itemAge`,


	) VALUES ( 
    ".$propertyType.", 
    ".$userID.", 
    '".$itemDescription."', 
    ".$Price.", 
	'".$Purpose."'
    ".$itemAge.", )";
	$status = mysqli_query($link,$sql) or die(mysqli_error($link));

I am grateful for your time. thanks.

[johanafm]

heiiumzz;10957980 wrote:

for the right syntax to use near ') VALUES ( , ,

means that your sql statement looks like

INSERT INTO sale_items (`user_id`, `propertyType`, `itemDescription`,`Price`,
`purpose`,`itemAge`,)
VALUES ( , ,

So, you've either supplied null or an empty string for (at least) the first two values. Also, there is a trailing , after itemAgewhich should not be there.

To deal with the missing values, you will need to check your input data for validity, either aborting on no input, or by supplying default values.

if (isset($_POST['user_id'])) {
	$user_id = (int) $_POST['user_id'];
}
else {
	# error handling
}
$property_type = empty($_POST['property_type'] ? 'default' : $_POST['property_type'];

# and so on

In case you are using the same script both to show the form initially as well as dealing with post data, the reason for the missing data is that no data has yet been posted the first time the script runs. Also, checking if (isset($POST)) is pointless when the script is run through a webserver, since $POST is always set, albeit empty.

# either
if (!empty($_POST))

# or
if (isset($_POST['name_of_your_submit_button']))

# or
if (count($_POST))

[heiiumzz]

anymore solutions for the problem? 😕

[Crowly]

You might need to escape the strings.

$sql = "INSERT INTO sale_items ( 
propertyType, 
user_id, 
itemDescription, 
Price, 
itemAge, 
purpose 
)
VALUES ( 
".$propertyType.", 
".$userID.", 
'".mysql_real_escape_string($itemDescription)."', 
".$Price.", 
".$itemAge.", 
'".mysql_real_escape_string($Purpose)."')";

$status = mysqli_query($link,$sql); 


    if($status){ 
        $message = "Item posted successfully.<br />"; 
        $message .= "<a href='index.php'>Home</a>"; 
    }else{ 
        // this will never happen if you use die() when executing the query
        $message = "Item post failed.<br />"; 
        $message .= "<a href='postSaleItem.html'>Try Again.</a>";
        // debugging
        $message .= "<br />".nl2br($sql);
    }

Always validate your input, so you are sure that numbers are numbers, variables that shouldnt be empty isnt empty, values are within expected ranges if needed and so on.

[heiiumzz]

Crowly;10958020 wrote:

You might need to escape the strings.

Always validate your input, so you are sure that numbers are numbers, variables that shouldnt be empty isnt empty, values are within expected ranges if needed and so on.

Sorry sir, Im a php newbie who takes up php for currently less than 4 weeks, I need specific instructions.

Thanks again.

[dagon]

heiiumzz;10958052 wrote:

Sorry sir, Im a php newbie who takes up php for currently less than 4 weeks, I need specific instructions.

Thanks again.

or you could do your own research based on the information provided.

[jeremyphphaven]

Try this... I've adjusted the query a tad... hopefully this will help you identify where the problem is (if it continues after you implement this query).

Note that you're table column names and variables are sometimes capitalized and sometimes not. try to be consistent with your naming.

$sql = "INSERT INTO sale_items set
        `user_id` = '" .$userID. "',
        `propertyType` = '" .$propertyType. "', 
        `itemDescription` = '" .$itemDescription. "', 
        `Price` = '" .$Price. "', 
        `purpose` = '" .$Purpose. "', 
        `itemAge`= '" .$itemAge. "'
";