Menu
Community /Pin to ProfileBookmark
@NogDogJun 22.2021 — #Side note: you should be adding those submitted parameters to your query by using a prepared query with bound parameters (best), or at least escaping their values and/or casting them to appropriate numeric types (messier and more prone to error than prepared statements); otherwise risking the possibility of SQL injection (whether malicious or accidental). Something like:
MySQL – syntax to use near ” at line 1 [Unknown]
Got the error from SQL when my wordings included ‘ Please help to fix it.
Error: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ” at line 1
“`
<?php
$host=”XXXXX”;
$user=”XXXXX”;
$pass=”XXXXX”;
$dbname=”XXXXX”;
$con=mysqli_connect($host,$user,$pass,$dbname);
if (mysqli_connect_errno($con))
{
echo “<h1>Failed to connect to MySQL: ” . mysqli_connect_error() .”</h1>”;
}
$guestID = $_GET[‘guestID’];
$guestSubject=$_POST[‘guestSubject’];
$guestSecSubject=$_POST[‘guestSecSubject’];
$guestContent=$_POST[‘guestContent’];
$sql=”UPDATE meiabbook SET guestSubject = ‘$guestSubject’, guestSecSubject` = ‘$guestSecSubject’, `guestContent` = ‘$guestContent’ WHERE `guestID` = $guestID”;
if (!mysqli_query($con,$sql))
{
die(‘Error: ‘ . mysqli_error($con));
}
else
echo “<script type=’text/javascript’>”;
echo “alert(‘Has been edited !’);”;
echo “window.location.href=’index.php’;”;
echo “</script>”;
mysqli_close($con);
?>
Sign in
to post a comment12 Comments(s) ↴
0
@NogDogJun 22.2021 — #Side note: you should be adding those submitted parameters to your query by using a prepared query with bound parameters (best), or at least escaping their values and/or casting them to appropriate numeric types (messier and more prone to error than prepared statements); otherwise risking the possibility of SQL injection (whether malicious or accidental). Something like:[code=php]
$sql = "UPDATE meiabbook SET guestSubject = ?, guestSecSubject = ?, guestContent = ? WHERE guestID = ?";
$stmt = mysqli_prepare($sql);
mysqli_stmt_bind_param($stmt, "sssi", $guestSubject, $guestSecSubject, $guestContent, $guestID);
if(mysqli_stmt_execute($stmt) == false) {
die('Error: ' . mysqli_error($con)); // Yuck: better to log the error details and just let the user know it failed
}
[/code]