PHP Help!

[Al Neri]

check out I detailed most of the problem...

http://pastebin.ca/80869

if you have AIM catch me at DASHXS thanks!!!

 

[kamper]

I'm guessing you need quotes around the values for IPA and VOTE in your insert statement.

You are also begging to be hacked via sql injection.

 

[imported_LoKe]

$query = "INSERT INTO \"survey1\" ( \"IDNO\" , \"IPA\" , \"VOTE\" ) VALUES (NULL , ".$domain.", ".$casted.");";

:shocked:

$query = "INSERT INTO survey1 (IDNO, IPA, VOTE) VALUES ('' , '$domain', '$casted')";

 

[Al Neri]

lokey thanks i did that and now i get...

INSERT INTO survey1 ( IDNO , IPA , VOTE ) VALUES (NULL , '', '')'Query failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1

that query shouldnt be ran until submit is clicked... what the hek?

 

[imported_LoKe]

Why are you using Null? It's two single quotes. =p

That's one hell of a modified script you're using.

 

[Al Neri]

loke - do u have aim? its not a modified script... i tried adding in those functions last second but got lazy and didnt implement them in. it

 

[imported_LoKe]

Dark 666 Tyrael

 

[tfinch2]

Validate your input.

 

[kamper]

Originally posted by: Don Rodriguez
lokey thanks i did that and now i get...

INSERT INTO survey1 ( IDNO , IPA , VOTE ) VALUES (NULL , '', '')'Query failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1

that query shouldnt be ran until submit is clicked... what the hek?

How exactly are we supposed to tell you what's wrong with your query when we don't know your schema? How about posting the table definition.

 

[pcthuglife]

$query = "INSERT INTO \"survey1\" ( \"IDNO\" , \"IPA\" , \"VOTE\" ) VALUES (NULL , ".$domain.", ".$casted.");";

could be:

$query = 'INSERT INTO survey1 (IDNO, IPA, VOTE) VALUES (0, \'' . htmlspecialchars($domain) . '\', \'' . htmlspecialchars($casted) . '\')';

EDIT: Note that I use all single quotes, they kinda of look like double quotes when displayed in my reply.