Posted by cover on 12/12/05 02:32

On Mon, 12 Dec 2005 10:20:59 +1300, Chris Hope
<blackhole@electrictoolbox.com> wrote:


>There's a comma before the closing bracket. I would say that's your
>error. echo mysql_error() after running the query and see what happens.
>Or alternatively echo out the sql string and paste it into the mysql
>console or phpMyAdmin etc.

caught the comma after installing the echo mysql_error(); line and now
have:
"You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use
near 'x 2" x .25', 'no notes')' at line 1" unless I remove the
measurements from the uhmwsize field which were 60' x 2" x .25"*

after blanking that field, the error came back to a more simple
"Column count doesn't match value count at row 1" which now makes me
wonder... Setting id as an integer when establishing the database,
what numerical entry should I enter into that?

>One other thing, where do all those values come from? Directly from the
>form with no escaping? If so, you need to read up on the topic of sql
>injection.

I use two forms to enter the data and until now, it's worked very well
(so far with fields of 12 or less). One form is the user input, the
second does the query and insert while echoing the values to the
screen of what the user just entered into the database.

>And one other thing... I personally believe you are better to write your
>insert query in the form:
>
>INSERT INTO tablename (fieldname1, fieldname2, ... ) VALUES ('value1',
>'value2', ...)

I've done it this way too - kind of got away from it which may have
been bad however, went back to it for this error solving and it made
no difference in the outcome or error.

>
>than not specity the fieldnames. Sure, it takes time to write your
>query, but if you add a column to the table at a later time you will
>break any existing insert queries for that table as the number of
>columns specified in your query won't match the number in the table.

[Back to original message]