ORACLE Query doesnt work with insert statement

Question

I have a question regarding this statement. its showing an error like this

Warning: oci_execute(): ORA-00984: column not allowed here in C:\xampp\htdocs\WeltesInformationCenter\Component_request\save.php on line 41

and my code is like this,

 $componentHistoryParse = oci_parse($conn, "INSERT INTO HISTORY_COMPONENT_CUTTING 
                    (BASE_PLATE, REQUESTER, REQUEST_DATE, QTY_PROPOSED, REMARKS, PROJECT_NAME, THICKNESS, REQ_STATUS)
             VALUES (:bp, $username, SYSDATE, :qt ,:rm , :pj, :tc, 'PENDING')");

oci_bind_by_name($componentHistoryParse, ":bp", $_POST['baseplate']);
oci_bind_by_name($componentHistoryParse, ":qt", $_POST['quantityToCut']);
oci_bind_by_name($componentHistoryParse, ":rm", $_POST['text_remarks']);
oci_bind_by_name($componentHistoryParse, ":pj", $_POST['projectName']);
oci_bind_by_name($componentHistoryParse, ":tc", $_POST['thickness']);

$componentHistoryRes = oci_execute($componentHistoryParse);

if($componentHistoryRes){
   oci_commit($conn);
} else {
   oci_rollback($conn);
}

and the column names in the table are

BASE_PLATE VARCHAR2, NAME VARCHAR2, REQUESTER VARCHAR2, REQUEST_DATE DATE, REMARKS VARCHAR2, PROJECT_NAME VARCHAR2, PROJECT_NO VARCHAR2, THICKNESS NUMBER, REQ_STATUS VARCHAR2, QTY_PROPOSED NUMBER

thebjorn · Accepted Answer · 2014-04-28 08:34:16Z

1

Try:

 $componentHistoryParse = oci_parse($conn, "INSERT INTO HISTORY_COMPONENT_CUTTING 
                (BASE_PLATE, REQUESTER, REQUEST_DATE, QTY_PROPOSED, REMARKS, PROJECT_NAME, THICKNESS, REQ_STATUS)
         VALUES (:bp, '$username', SYSDATE, :qt ,:rm , :pj, :tc, 'PENDING')");

i.e. quotes around $username

answered Apr 28, 2014 at 8:34

thebjorn

27.6k12 gold badges107 silver badges152 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Joachim Isaksson · Accepted Answer · 2014-04-28 08:34:22Z

1

$username expands to just the value without any quotes, which then the database sees as a column name, not a string.

You could fix it by quoting username as '$username' but - better to avoid SQL injection - you should really put username in a parameter as you do the other values.

answered Apr 28, 2014 at 8:34

Joachim Isaksson

182k28 gold badges297 silver badges307 bronze badges

Collectives™ on Stack Overflow

ORACLE Query doesnt work with insert statement

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related