Mysql SYNTAX error - please help!

by 10 replies
12
Hi,

I have been pulling my hair out over this syntax error. Can someone please tell me where I have it wrong.

Code:
mysql_query("UPDATE `gemps_shares` SET `given_gemps` = given_gemps + " . $gemps . ", `total_gemps` = given_gemps + link_gemps WHERE `user_id` = '$_REQUEST[user_id]' AND `user_id` = '$_REQUEST[owner_id]'") or die (mysql_error());
#programming #error #mysql #syntax
  • What is the error its giving?

    Try this
    PHP Code:
    mysql_query("UPDATE `gemps_shares` SET `given_gemps` = given_gemps + " . $gemps . ", `total_gemps` = given_gemps + link_gemps 
        WHERE `user_id` = '"     . $_REQUEST['user_id'] . "' 
        AND `user_id` = '"     . $_REQUEST['owner_id'] . "'") or die (mysql_error()); 
    By the way, those should all be escaped as they are strings.
    Your open to SQL Injections.
    eg. at the minimum
    PHP Code:
    mysql_query("UPDATE `gemps_shares` SET `given_gemps` = given_gemps + " . mysql_real_escape_string($gemps) . ", `total_gemps` = given_gemps + link_gemps
        WHERE `user_id` = '"     . mysql_real_escape_string($_REQUEST['user_id']) . "' AND `user_id` = '" . mysql_real_escape_string($_REQUEST['owner_id']) . "'") or die (mysql_error()); 
  • Why are there ' around the table and column names?

    • [1] reply
    • You don't know MySQL do you?
      Yes they aren't neccessary, but are commonly added to MySQL queries by PHPMyAdmin and other query builders.
      • [1] reply
  • It is very common in MySQL to have ` ticks around field names and table names and single quotes around values.

    Reference to the single quotes around values: is why I suggested using mysql_real_escape_string, because using these single quotes around field values enforces that it is a string, thus allowing any input.
  • Folks let's chill with the crude remarks and get back to helping the OP.

    To the OP:

    mysql_query("UPDATE `gemps_shares` SET `given_gemps` = given_gemps + " . $gemps . ", `total_gemps` = given_gemps + link_gemps WHERE `user_id` = '$_REQUEST[user_id]' AND `user_id` = '$_REQUEST[owner_id]'") or die (mysql_error());

    CHANGE TO:

    mysql_query("UPDATE `gemps_shares` SET `given_gemps` = given_gemps + " . $gemps . ", `total_gemps` = given_gemps + link_gemps WHERE `user_id` = '" . $_REQUEST['user_id'] . "' AND `user_id` = '" . $_REQUEST['owner_id'] . "'") or die (mysql_error());

    Basically what's happening is you are trying to parse the $_REQUEST variables but when you wrap them in ' it tells PHP to not parse them and use that as the literal value. So the query is literally looking for a user_id that is set to $_REQUEST[user_id] as opposed to the actual variable value.
  • @ Christian Little
    Your code is the same as mine, except now you took the escaping out.
    Whether your passing an int or not does not matter if it is inside quotes, as the quotes cause it to be parsed as a string allowing any characters to be in there. There for you are adding SQL Injection vulnerabilities.
    Just mentioning it
  • Try using SUM function to add
Join the discussion

Next Topics on Trending Feed