Parse error

[bharadwaj91]

Hi folks

I have just started using PHP and i need help as i am getting this error repeatedly

Parse error: syntax error, unexpected T_CONSTANT_ENCAPSED_STRING in C:\wamp\www\Swim\index.php on line 24

My code is :

<?php

include_once("includes/common.php");
include_once("includes/SmartyExtend.class.php");


if(empty($_POST))
{
	include_once ("smarty/templates/index.tpl");

}
else 
{
	//Validations
	if($_POST['Swimmer Name'] == "")
	{
		echo " Name should not be empty";
		exit;
	}


//POST the data into DB
$db = new MySQL();
$query="INSERT INTO tblSwimmer(fldSwimmerName,fldAge) VALUES("'$_POST[Swimmer Name]'",'$_POST[Age]')";
mysql_query($query);

echo "Inserted correctly";

}



?>

[bradgrafelman]

Welcome to PHPBuilder! When posting PHP code, please use the board's [noparse]

..

[/noparse] bbcode tags as they make your code much easier to read and analyze.

As for your code above, I see three issues:

1. User-supplied data should never be placed directly into a SQL query string, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors. Instead, you must first sanitize the data, such as with a function like [man]mysql_real_escape_string/man (for string data) or by using prepared statements. See this man page for more info: [man]security.database.sql-injection[/man].

2. See the manual page [man]string[/man] for examples of how to include items in an array in a string. For example, without using the 'complex notation' or concatenation, you can't reference array indexes containing spaces.

3. Note that $POST['Swimmer Name'] will never exist, nor will any other such name that includes a space (or a period). The following note is from the manual page [man]variables.external[/man]:
   

   PHP Manual wrote:

   Dots and spaces in variable names are converted to underscores. For example <input name="a.b" /> becomes $_REQUEST["a_b"].

Also note that there is a stickied thread dedicated to Parse error issues in the General Help form.

[Derokorian]

Also the line defining the query has syntax error:

$query="INSERT INTO tblSwimmer(fldSwimmerName,fldAge) VALUES("'$_POST[Swimmer Name]'",'$_POST[Age]')"; 

Notice after the VALUES keyword you have a double quote, this CLOSES the delimited string you are trying to create then you open another with the single quote, you need to remove the double quotes around $_POST[swimmer name] (also you need to change this reference to be accurate as BG pointed out.

$query="INSERT INTO tblSwimmer(fldSwimmerName,fldAge) VALUES('$_POST[Swimmer_Name]','$_POST[Age]')";