PHP + MySQL "INSERT INTO" error

Question

I have this sql string:

$sql = "INSERT INTO foto (id, nome, check)
            VALUES ('', '" . md5($file) . '.' .$Type. "', '" . md5($file2) . '.' .$Type2. "')";

but it returns this error:

INSERT INTO foto (nome, check) VALUES ('57f030f902b9fbd6907d1af52ec2a1ba.jpg', '8c96b1254a72dbd080a9b79a9a224865.jpg')
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'check) VALUES ('57f030f902b9fbd6907d1af52ec2a1ba.jpg', '8c96b1254a72dbd080a9' at line 1

'

md5($file) + $Type = 57f030f902b9fbd6907d1af52ec2a1ba.jpg
md5($file2) + $Type2 = 8c96b1254a72dbd080a9b79a9a224865.jpg

What's the problem? How can I solve it?

You really should be using SQL placeholders like ? or :nome for this, because the way you're composing this query string seems completely reckless. Are any of those values even properly escaped? — tadman
– tadman, Commented Nov 7, 2014 at 18:23

Community · Accepted Answer · 2017-05-23 12:27:18Z

3

check is a MySQL reserved word

http://dev.mysql.com/doc/refman/5.5/en/reserved-words.html

which requires it to be wrapped in backticks, or rename it to checks for example in your table.

$sql = "INSERT INTO foto (id, nome, `check`)

if you want to rename it, then just do

$sql = "INSERT INTO foto (id, nome, checks)

which won't throw an error; the option is yours.

Notice where the error starts and points to:

>...MySQL server version for the right syntax to use near 'check
                                                          ^ starts there

Plus, once you've fixed that, your code would still be open to SQL injection.
Use mysqli with prepared statements, or PDO with prepared statements, they're much safer.

edited May 23, 2017 at 12:27

CommunityBot

11 silver badge

answered Nov 7, 2014 at 18:21

Funk Forty Niner

74.2k14 gold badges71 silver badges146 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

MR10 Over a year ago

Thank you. "check" was the problem. I know that is an unsafe query but it is inside a secure and private area of the website in which only one person can enter. I will, however, once finished the entire code, make sure this area too. Thank you very much.

Collectives™ on Stack Overflow

PHP + MySQL "INSERT INTO" error

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related