help before i do something i may regret

[burnist]

I am runnig this query from a file


$DB_site->query("INSERT INTO item_cats (name,battle,order,description) VALUES (' ".$_POST['itemcatname']." ',' ".$_POST['battleitemcat']." ',' ". $_POST['catdisplayorder']." ',' ". $_POST['itemcatdescription']." ') ");


The output should be a redirect page called on the next line(s) but instead i get the following error

Invalid SQL: INSERT INTO item_cats (name,battle,order,description) VALUES (' test ',' 1 ',' 1 ',' test ')
mysql error: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'order,description) VALUES (' test ',' 1 ',' 1 ',' test ')' at l

mysql error number: 1064

I have had some one on my msn list look over the query and they cannot find a problem with it. This is driving me insane and anyhelp would be greatly appreciated :tired: :rolleyes:

[Dean C]

You don't need to quote numerical values.

[burnist]

no luck, now i gives

Invalid SQL: INSERT INTO item_cats (name,battle,order,description) VALUES (' test ',1,1,' test ')
mysql error: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'order,description) VALUES (' test ',1,1,' test ')' at line 1

mysql error number: 1064

[assassingod]

You cant use 'order' as a column name. Change it

[burnist]

thanks assassingod, that worked straight away :)

[assassingod]

No problem:)

[burnist]

now im having problems with mysql_fetch_array()


$catfields = $DB_site->query("SELECT id, name FROM " . TABLE_PREFIX . " item_cats");
while ($catinfo = $DB_site->fetch_array($catfields))
{
echo'<tr valign="top" align="center">
<td class="alt1" align="left"><b>$catinfo[name]</b></a>&nbsp;</td>
<td class="alt1"><a href="itemadmin.php?do=deloldcat&id=$catinfo[id]">Delete</a></td>
<td class="alt1"><a href="itemadmin.php?do=editoldcat&id=$catinfo[id]">Edit</a></td>
</tr>';
}

This is showing the right number of rows (ie same number of rows as in that database but the text it shows is $catinfo[name] and i cant see why, as far as i can tell the variable have the same name etc (slightly dyslixic so dont hold me to that ;) )

[filburt1]

As an unrelated note, you have massive SQL injection issues. Use addslashes() for every string used in a query, no exceptions.

[burnist]

i assume you are talking about the first post? I probobly will later but its in the admin panel so its not really a hugh problem but i will update it in my file :)

[Velocd]

This is showing the right number of rows (ie same number of rows as in that database but the text it shows is $catinfo[name] and i cant see why, as far as i can tell the variable have the same name etc (slightly dyslixic so dont hold me to that )

You must set a string with double quotes if you intend to include variables.

e.g.

$name = "$bbuserinfo[username]";

Single quotes if otherwise:

$name = 'John';