PHP Mysql error - please help

Dev Shed Forums Sponsor:

March 13th, 2013, 12:42 PM

realseoforums

Registered User

Join Date: Mar 2013

Posts: 4

Time spent in forums: 42 m 50 sec
Reputation Power: 0

PHP-General - PHP Mysql error - please help

Hello I keep getting this error

Code:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'desc, board) VALUES ('hi', 'hi', 'Proxies')' at line 1

This is my php code

Code:

if ( isset( $_POST['submit'] ) ) { 


$title = htmlentities($_POST['title']);
$desc = htmlentities($_POST['content']);
$board_id = $_GET["title"];

mysql_connect("host","user","pass");
mysql_select_db("db");

mysql_query("INSERT INTO thread (title, desc, board)
VALUES ('$title', '$desc', '$board_id')");
echo mysql_error();
}

why am I getting that error?

March 13th, 2013, 12:44 PM

paulh1983

Contributing User

Join Date: Dec 2004

Posts: 2,237

Time spent in forums: 2 Weeks 1 Day 11 h 3 m 46 sec
Reputation Power: 201

is desc not a KEYWORD in mysql.. you should optionally put ` around your field so `title` etc..

March 13th, 2013, 12:49 PM

realseoforums

Registered User

Join Date: Mar 2013

Posts: 4

Time spent in forums: 42 m 50 sec
Reputation Power: 0

Quote:

Originally Posted by paulh1983

is desc not a KEYWORD in mysql.. you should optionally put ` around your field so `title` etc..

Thank you

it works now

March 13th, 2013, 01:08 PM

Jacques1

pollyanna

Join Date: Jul 2012

Location: Germany

Posts: 1,881

Time spent in forums: 1 Month 2 Weeks 2 Days 8 h 21 m 26 sec
Reputation Power: 813

Hi,

actually, you shouldn't use keywords at all. This backticks workaround is pretty ugly and error-prone.

And the usual sermon:

The MySQL extension you're using is obsolete since almost 10 years and will be officially deprecated in the next PHP version. This means every call to mysql_connect(), mysql_query() etc. will generate a warning.

If you have any chance to switch to one of the “new” extensions, do it! They have several new features. Most importantly, they support prepared statements to prevent SQL injections (which your code is vulnerable against).

The old extension was written for MySQL 3. Those days are long gone. It's the 21. century now.

Also check the link in my signature to avoid security holes.htmlentities() does not protect against SQL injections, it makes absolutely no sense in this context.

Comments on this post

Strider64 agrees!

__________________
The 6 worst sins of security • The mystery of errors and exceptions

PHP-General - PHP Mysql error - please help

Developer Shed Advertisers and Affiliates