Re: Mysqli issue

On Sep 11, 2008, at 11:29 AM, Wolf wrote:

---- Jason Pruim <japruim@raoset.com> wrote:

No political undertones in this one I promise! :) Attempting to setup a prepared statement in php that will update a record in a mysql database using mysqli Here is the relevant code: $stmt = mysqli_stmt_init($link); mysqli_stmt_prepare($stmt, "UPDATE purl.schreur (FName, LName, email, phone, record, subscribed, date, IPAddress, Business, Address1, City, State, Zip, Coffee, Meeting, areaPlans) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)"); mysqli_stmt_bind_param($stmt, 'ssssssssssssssssss', $_POST['txtFName'], $_POST['txtLName'], $_POST['txtEmail'], $_POST['txtPhone'], $_POST['txturl'], $_POST['record'], $_POST['subscribed'],$date, $_SERVER['REMOTE_ADDR'], $_POST['txtBusiness'], $_POST['txtAddress1'], $_POST['txtCity'], $_POST['txtState'], $_POST['txtZip'], $_POST['rdoCoffee'], $_POST['rdoTime'], $_POST['areaPlans']) ;//or die(mysqli_error($link)); echo "<BR>Dump of stmt:<BR>"; mysqli_stmt_execute($stmt) or die(mysqli_error($link)); Here is my error message: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '(FName, LName, email, phone, record, subscribed, date, IPAddress, Business, Addr' at line 1 Now I may just be being dense but I can't figure out the problem... Migraines are not helping right now though.... Can anyone see my stupid mistake? :)

OK, you asked for it... You aren't checking your stuff before dumping it. None of it...

My understanding is that mysqli prepared statements took care of most of that. I do need to learn a little more about that though to be sure.

So, you should be taking the post variables and slapping them into a checker. Then, your statement should be more along the lines of: mysqli_stmt_bind_param($stmt, 'ssssssssssssssssss','$txtFName','$txtLName','$txtEmail','$txtPhone','$txturl','$record','$subscribed',$date, '$REMOTE_ADDR','$txtBusiness','$txtAddress1','$txtCity','$txtState','$txtZip','$rdoCoffee','$rdoTime','$areaPlans') ;

Isn't that just a style difference though? Does it matter if I pull from $_POST['txtZip'], $txtZip, or $Zip? Assuming that I am properly escaping/protecting against sql injection? And yes I really am interested :) -- Jason Pruim Raoset Inc. Technology Manager MQC Specialist 11287 James St Holland, MI 49424 www.raoset.com japruim@raoset.com