mysql problem

CoryMathews · 02-21-2008, 11:50 PM

Quote:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's foremost network protocol analyzer, and is the de facto (and often de jure) st' at line 2

I am getting this error message from my query. No idea what it means. Any Ideas?

Code:

$sqlInsert = mysql_query("INSERT INTO table (win, lin, mac, recommended, sName , version , longDesc , license , added, updated, homepageLink , imageLink, timeInt, category, MainCategory)"."
	VALUES ('$win', '$lin', '$mac', '$recommended', '$sName', '$version', '$longDesc', '$license', '$added', '$updated', '$homepageLink', '$imageLink', '$timeInt', '$category', '$MainCategory')") or die(mysql_error());

SOCK · 02-22-2008, 12:29 AM

You're trying to insert unescaped data. One of those variables is a string that has a single quote in it somewhere, indicated by "s foremost network protocol analyzer, and is the de facto (and often de jure) st" in the error message. My guess is that first 's' shown is part of a possessive noun, and the reason it's failing is because of the apostrophe (a single quote).

Your script is completely open to SQL injection. Escape them strings!!

CoryMathews · 02-22-2008, 12:33 AM

thanks sock. so obvious now.