single quote mark error is script

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • nomad
    Recognized Expert Contributor
    • Mar 2007
    • 664
    #1

    single quote mark error is script

    I have a testimonial page where the user can write a testimonial for me.
    I get this error message if the user use a single quote mark.
    example:
    Demonstrated professionalism and creativity as the company's web and marketing materials designer.

    Will produce this error;
    You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's web and marketing materials designer. ')' at line 1

    here is my code for the php:
    Code:
    //check for required fields from the form
if ((!$_POST[company]) || (!$_POST[fname]) || (!$_POST[comments])) {
	header("Location: addtestimonial.html");
	exit;
}
//connect to server and select database
bab bab bab...


//create and issue the first query
$add_testimo = "insert into testimo values ('', '$_POST[company]', now(), '$_POST[fname]', '$_POST[comments]') ";
mysql_query($add_testimo,$conn) or die(mysql_error());

//get the id of the last query
$testimo_id = mysql_insert_id();

//create nice message for user
$display_block = "<P>The <strong>$topic_title</strong> testimonial has been created. <br>
You wrote: <br>
$_POST[comments], <br> 
$_POST[company], <br>
$_POST[fname],<P>
Thank you for your business and your time. If you need any upgrades
please ket ne know.</p>";
?>
    HTML code
    Code:
     <form method=post action="do_addtestimonial.php">
<p align="left"><strong class="maintext">Your Companies Name:</strong><br>
<input type="text" name="company" size=40 maxlength=150>
<p align="left"><strong class="maintext">Your First Name:</strong><br>
  <input type="text" name="fname" size=40 maxlength=150>
<P align="left"><strong class="maintext">Your Testimonial:</strong><br>
  <textarea name="comments" cols=75 rows=5 wrap=virtual id="comments"></textarea>
<P align="left"><input type="submit" name="submit" value="Add Testimonial">
</p>
</form>
    my db for the comment is
    comments text should I use varchar instead?

    Any help would be great.

    damon
    Tags: None
    • Dormilich
      Recognized Expert Expert
      • Aug 2008
      • 8694
      #2
      first thing to notice $_POST[name] should be $_POST["name"], otherwise you get a couple of notices.

      second, you’re wide open to SQL Injection. (which is the reason for your error)
      it is careless, not to treat user input. the least you should do is using mysql_real_esca pe_string().


      third, variable testing
      Code:
      if ((!$_POST[company]) || (!$_POST[fname]) || (!$_POST[fname])) {
// should be better
if (!isset($_POST["company"], $_POST["fname"], $_POST["fname"])) {

        Comment

        • nomad
          Recognized Expert Contributor
          • Mar 2007
          • 664
          #3
          Thanks Dormilich...
          I hope this will help I'm new to PHP.

          damon

            Comment

            • nomad
              Recognized Expert Contributor
              • Mar 2007
              • 664
              #4
              I'm still getting the error and I not to clear about the mysql_real_esca pe_string().
              Where do I place it and what does it look like.
              This is not a class assignment. I using a book PHP, MySQL and Apache all in one, by Julie C. Meloni.
              There was an example and I redesigned it.

              Here is my updated code:
              Code:
              <?php
//check for required fields from the form
if (!isset($_POST["company"], $_POST["fname"], $_POST["comments"])) {
	header("Location: addtestimonial.html");
	exit;
}

//connect to server and select database
$conn = mysql_connect("localhost", "nomad", "nomad") or die(mysql_error());
mysql_select_db("dwdesign", $conn)  or die(mysql_error());

//create and issue the first query
$add_testimo = "insert into testimo values ('', '$_POST[company]', now(), '$_POST[fname]', '$_POST[comments]')";

mysql_query($add_testimo,$conn) or die(mysql_error());

//get the id of the last query
$testimo_id = mysql_insert_id();


//create nice message for user
$display_block = "<P>The <strong>$topic_title</strong> testimonial has been created. <br>
You wrote: <br>
$_POST[comments], <br> 
$_POST[company], <br>
$_POST[fname],<P>
Thank you for your business and your time. If you need any upgrades
please ket ne know.</p>";
?>
<html>
<head>
<title>New Testimonial Added</title>
</head>
<body>
<h1>Testimonial Added</h1>
<?php echo $display_block; ?>
</body>
</html>
              Also in my table I have a field called
              comments which is a text data type
              I did not know how to assign a single quote ("'") amongst that values.

              Once again any help would be great.
              damo

                Comment

                • Dormilich
                  Recognized Expert Expert
                  • Aug 2008
                  • 8694
                  #5
                  I using a book PHP, MySQL and Apache all in one, by Julie C. Meloni.
                  it’s a poor book, if it doesn’t mention SQL Injection.

                  how to use mysql_real_esca pe_string() is mentioned in the manual (ref. to the given link), there are also examples given.

                    Comment

                    • nomad
                      Recognized Expert Contributor
                      • Mar 2007
                      • 664
                      #6
                      Still at a lost I read it twice I even did a google search on the info.
                      Really could use some help.
                      I have no ideal where to place the code.
                      is if within the php code or is it with then the db using a SQL query?


                      thanks
                      damon

                        Comment

                        • Dormilich
                          Recognized Expert Expert
                          • Aug 2008
                          • 8694
                          #7
                          since it’s a PHP function, it is to be applied in the PHP code, just like in the examples.

                          Code:
                          $query = sprintf("SELECT * FROM users WHERE user='%s' AND password='%s'",
            mysql_real_escape_string($user),
            mysql_real_escape_string($password));
$result = mysql_query($query);

                            Comment

                            • nomad
                              Recognized Expert Contributor
                              • Mar 2007
                              • 664
                              #8
                              finally I figure it out.

                                Comment

                                • Dormilich
                                  Recognized Expert Expert
                                  • Aug 2008
                                  • 8694
                                  #9
                                  did you notice that this is the example from the manual?

                                    Comment

                                    • dlite922
                                      Recognized Expert Top Contributor
                                      • Dec 2007
                                      • 1586
                                      #10
                                      Originally posted by Dormilich
                                      did you notice that this is the example from the manual?
                                      ^ LOL

                                      Dan,
                                      [the php nut @]

                                        Comment

                                        • nomad
                                          Recognized Expert Contributor
                                          • Mar 2007
                                          • 664
                                          #11
                                          Yes...
                                          Thanks for the help I will be back for more help
                                          soon

                                            Comment

                                            Previous template Next
                                            Working...