Sql Syntax Error in Php

[debsdk]

Here is the following code snippet of php i wrote.

$password=$_POST['password'];
//$password = crypt($password);
$key=md5($password);
$iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_CFB);
$iv=mcrypt_create_iv($iv_size, MCRYPT_RAND);
$password=mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $key, $password, MCRYPT_MODE_CFB, $iv);
/*if (!get_magic_quotes_gpc())
{
$_POST['password'] = addslashes($_POST['password']);
}*/
// now we insert it into the database
if($flag==0 && $flag1==0)
{
echo ' Login Success ' ;
$insert = "INSERT INTO users(email,password,date,month,year,city,state,country,name,sex,address,error,key,iv)
VALUES ('$_POST[email]' ,'$password' ,'$_POST[date]' ,'$_POST[month]', '$_POST[year]', '$_POST[city]',
'$_POST[state]', '$_POST[country]', '$_POST[name]', '$_POST[sex]', '$_POST[address]','nothing','$key','$iv')";
$add_member = mysql_query($insert,$con);
if(!$add_member)
die(mysql_error());
header("location:home.php");
}

but on execution m getting the following error:

Login Success You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'key,iv) VALUES ('vxerj' ,'&¡ø' ,'-1' ,'-1', '-1', 'ada', ' at line 1

Help please!

[Matthew1980]

Hi there DebSDK,

Welcome to WebmasterWorld!

Your query needs tidying up methinks:

$insert = "INSERT INTO `users` (`email`, `password`, `date`, `month`, `year`, `city`, `state`, `country`, `name`, `sex`, `address,error`, `key`, `iv`)
VALUES
('".$_POST['email']."' ,'".$password."' ,'".$_POST['date']."' ,'".$_POST['month']."', '".$_POST['year']."', '".$_POST['city']."',
'".$_POST['state']."', '".$_POST['country']."', '".$_POST['name']."', '".$_POST['sex']."', '".$_POST['address']."','','".$key."','".$iv."')";

There is something that you do need to do with the $_POST data before using it in the SQL - SANITISE it, this query is open to so much abuse - I cannot emphasise this enough.

This amendment *should* be ok, though, typed OTF.

The $_POST elements in this would have thrown a error as php would have assumed them as constants, that's why I have concatenated them.

See how you get on.

Cheers,
MRb

[debsdk]

I did that, but now i am getting error
"Column count doesn't match value count at row 1"

[Matthew1980]

Sorry typo:-

$insert = "INSERT INTO `users` (`email`, `password`, `date`, `month`, `year`, `city`, `state`, `country`, `name`, `sex`, `address`, `error`, `key`, `iv`)

Add the bolded text.

Cheers,
MRb

[debsdk]

Thanx dude! this page is now working up perfect.

Another doubt.
Can i add session() to register a name on page and then use it to redirect to another page with than name,like his profile?
It is better than creating diff pager for every user.

[Matthew1980]

session_start() then just assign the data that you want like this:-

<?php
session_start();

$_SESSION['myname'] = "My name";
?>

Then as long as you have the session_start() declared at the top of every file you wish to have access to that variable, you should be fine.

Have fun with the experimenting!

Cheers,
MRb

[debsdk]

Hmm.

And what about like adding header("location:home.php?id=$sesid") ?
What exactly will ?id=$sesid do?
Here $sesid is unique id for session i am declaring.

And how to use that id in diff pages?

[Matthew1980]

Hi there debsdk,

$_SESSION data (if set or instantiated) is global data which means that it doesn't need to be passed from page to page via the URL - it's already there that is the definition of a global.

Other such globals are $_POST $_GET $_COOKIE; as long as they are set declared (you can have it explicitly defined as NULL), you can access them.

Besides having too much data going through the URL is not a very SEO friendly way of doing things - this is what I consider to be the primary function of $_SESSION data - so long as the sessions_start() is declared at the top of every file that will need to have access to this data - you'll be fine.

A note: $_SESSION's are technically $_COOKIE's because there is a PHPSESSID cookie that will be there in the cookie list when you start to use sessions_start() this is what php uses to keep connected to the data - which brings in the default time limit which a $_SESSION lasts for which, if memory calls is 24 mins, though you can edit this.

>>What exactly will ?id=$sesid do?

This will mean that $_GET['id'] will hold the value of whatever is in $sesid...

Hope I haven't confused you too much; I half expect Rocknbil to help me out here; the fountain of knowledge that he is (Much kudos Mr Bill!)

Cheers,
MRb

[debsdk]

Thanks!
I got it.

Cheers