HELP! I keep getting this error in my form.

[chayallc]

Please help me. I keep getting this coding error...
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 10

Here is the code from my actionfrm.php file:

<?php include('dbconnect.php'); ?>

<?php
$membername=$POST['membername'];
if(isset($POST['username']) and $POST['username']!=""){
$sponsorid=$SESSION['memberid_for_sp'];
}else{
$sponsorid=0;
}
$dateofjoining=date("Y-m-d");;
$address=$POST['address'];
$city=$POST['city'];
$state=$POST['state'];
$country=$POST['country'];
$mobileno=$POST['mobileno'];
$countrycode=$POST['countrycode'];
$dateofbirth=$POST['dateofbirth'];
$emailid=$POST['emailid'];
$myid=$_SESSION['memberid'];
$sql="UPDATE personal SET membername='$membername',
sponsorid='$sponsorid',
dateofjoining='$dateofjoining',
address='$address',
city='$city',
state='$state',
country='$country',
mobileno='$mobileno',
countrycode='$countrycode',
dateofbirth='$dateofbirth', emailid='$emailid' WHERE memberid=$myid";

if (!mysql_query($sql))
{
die('Error: ' . mysql_error());
}
echo "1 record added";
header('Location: coapp.php?msg=1');

//return $frmdetail.php;

?>

PLEASE, PLEASE HELP ME! I really want to get this resolved. I'm a newbie to php programming.

Eric

[bradgrafelman]

Try printing out the SQL query string itself and visually inspecting it - look for missing data.

Also, note that placing user-supplied data directly into a SQL query leaves you vulnerable to SQL injection attacks and/or just plain SQL errors. See [man]security.database.sql-injection[/man] for an introduction to the former if you're not aware of the topic.

[chayallc]

bradgrafelman;11008639 wrote:

Try printing out the SQL query string itself and visually inspecting it - look for missing data.

Also, note that placing user-supplied data directly into a SQL query leaves you vulnerable to SQL injection attacks and/or just plain SQL errors. See [man]security.database.sql-injection[/man] for an introduction to the former if you're not aware of the topic.

Brad,

I tried that and couldn't find the problem. How would you recommend I fix this or is it even fixable? I really want to get this off my plate.

Thanks for your reply.

[laserlight]

What is the SQL query that was printed?

[bradgrafelman]

Can you show us what the query looks like when you echo it out?

[chayallc]

i don't know, i'm helping a friend who had this code written. It is supposed to be the 2nd page of an enrollment form. This is really bizarre to me

[chayallc]

How do I echo it out?

[bradgrafelman]

chayallc;11008659 wrote:

How do I echo it out?

By using [man]echo[/man] (or [man]print[/man] if you prefer).

[chayallc]

where in the code do i place the command?

[bradgrafelman]

Wherever you want, really - just so long as it gets executed. It would probably make the most sense, however, to place it inside the if() block that gets executed when an error occurs.

[chayallc]

bradgrafelman;11008665 wrote:

Wherever you want, really - just so long as it gets executed. It would probably make the most sense, however, to place it inside the if() block that gets executed when an error occurs.

so if I place like here...
<?php include('dbconnect.php'); ?>

<?php
echo
$membername=$POST['membername'];
if(isset($POST['username']) and $POST['username']!=""){
$sponsorid=$SESSION['memberid_for_sp'];
}else{
$sponsorid=0;
}.....

would it print out what you need to see from the rest of the script?

[chayallc]

bradgrafelman;11008665 wrote:

Wherever you want, really - just so long as it gets executed. It would probably make the most sense, however, to place it inside the if() block that gets executed when an error occurs.

i just echoed each line so that you could see the output....
testing42012-07-16746 pomona stpomonaCAUSA818732159211989/03/[e-mail] personal SET membername='testing4', sponsorid='', dateofjoining='2012-07-16', address='746 pomona st', city='pomona', state='CA', country='USA', mobileno='8187321592', countrycode='1', dateofbirth='1989/03/26', emailid='[e-mail]' WHERE memberid=Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 10

can you tell me where the problem is?

[bradgrafelman]

Well the first problem I see is that you've got everything all jumbled together. It'sreallyhardtoreadthingslikethatwhentheyaren'tspacedoutproperly,y'know?

However, the real problem is as I suspected - you've got missing data. Take a look at the WHERE condition of the query:

WHERE memberid=

Notice something missing?

Going back to the code, we see that the missing value is supposed to be coming from $SESSION['memberid'], yet you haven't:

1. Started a session (e.g. via [man]session_start/man) in any code you've shown us.

2. Verified that $_SESSION['memberid'] actually exists and isn't empty (e.g. using [man]empty/man) before attempting to use it.

[chayallc]

bradgrafelman;11008671 wrote:

Well the first problem I see is that you've got everything all jumbled together. It'sreallyhardtoreadthingslikethatwhentheyaren'tspacedoutproperly,y'know?

However, the real problem is as I suspected - you've got missing data. Take a look at the WHERE condition of the query:

WHERE memberid=

Notice something missing?

Going back to the code, we see that the missing value is supposed to be coming from $SESSION['memberid'], yet you haven't:

1. Started a session (e.g. via [man]session_start/man) in any code you've shown us.

2. Verified that $_SESSION['memberid'] actually exists and isn't empty (e.g. using [man]empty/man) before attempting to use it.

Sorry about the running together...that's how it printed out. So, I think I correctly added it to the code, please see below...

$membername=$POST['membername'];
if(isset($POST['username']) and $POST['username']!=""){
echo $sponsorid=$SESSION['memberid_for_sp'];
}else{
$sponsorid=0;
{
$myid=$_SESSION['memberid'];
}else{
$myid=0;
}...

What do you think?

[chayallc]

Brad,

this is the modified code....

<?php include('dbconnect.php'); ?>

<?php
echo
$membername=$POST['membername'];
if(isset($POST['username']) and $POST['username']!=""){
echo $sponsorid=$SESSION['memberid_for_sp'];
}else{
$sponsorid=0;
{
$myid=$_SESSION['memberid'];
}

and here is the new error...

Parse error: syntax error, unexpected $end in /home/content/k/a/p/kapilsud12345/html/tlhdirect/backroom/actionfrm.php on line 44

Am I getting closer to the solution?

[chayallc]

Is there anyone who can help me fix this code. I think I lost Brad.

[Weedpacket]

Maybe he's asleep. Humans have been known to do that on occasion. Or he has his own things to do which, naturally, are of a higher priority to him than are yours.

When posting code and other formatted data, please use the formatting markup tags described in the FAQs to mark up your code.

Your latest edits have resulted in an extra "{".

And you havent:

bradgrafelman wrote:

1. Started a session (e.g. via session_start()) in any code you've shown us.

2. Verified that $_SESSION['memberid'] actually exists and isn't empty (e.g. using empty()) before attempting to use it.

[Bunkermaster]

Has anyone tried removing the extra semi colon at the end of line 10? Shouldn't give an error message but it bugs me that no one mentioned it (that I saw).

[bradgrafelman]

Weedpacket;11008723 wrote:

Maybe he's asleep.

Or maybe he's just patiently waiting for the OP to address the two actual issues previously mentioned (referenced in your quote). :p

Bunkermaster;11008801 wrote:

it bugs me that no one mentioned it (that I saw).

I haven't mentioned it because I was far more concerned with the several other items that are issues. (And no, extraneous semicolons not sandwiched in the middle of a statement don't do any harm - they terminate a nonexistent statement; think of it almost like a NOOP instruction.)

[Bunkermaster]

Yes but it serves no purpose. It's unacceptable!