• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

PHP debugging issue

J

Jadenrose

Weaksauce
Joined
Apr 30, 2005
Messages
102
Ok, I've been staring at this long enough and I've searched and can't figure out where my problem is. This is the error code I am getting:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ' City Sport 50='', =''' at line 1
Click to expand...

And here is the code it is referencing to. I know this because of how it loads differently when I take the "or die" out of the code.

Code: 
// Check if this item already exists in the users cart table
		$result = mysql_query("select count(*) from cart where cookieId = '" . GetCartId() . "', $prod_name='$row[prod_name]', $item_desc='$row[item_desc]'") or die(mysql_error());
		$row = mysql_fetch_row($result);
		$numRows = $row[0];

Any help will, as always, be greatly greatly appreciated!!
 
should it be prod_name=... and item_desc=... instead of $prod_name=... and $item_desc=... (dollar signs)?
 
That's how it was originally and it still kicks back the same code. only in the error code its prod_name=City sport 50 item_desc..."

I was thinking it might be the way I'm trying to set up the variable for item_desc.

Code: 
$qty = $_REQUEST['qty'];
$first_color = $_REQUEST['first_color'];
$second_color = $_REQUEST['second_color'];
$warranty = $_REQUEST['warranty'];
$item_desc = $first_color . ' | ' . $second_color . ' | ' . $warranty;
 
giving us an error without the new, modified code is useless.

are you doing like:
Code: 
$sql = "select ...";
echo $sql;
mysql_query($sql) or die(...);
...
 
The query:

Code: 
$result = mysql_query("select count(*) from cart where cookieId = '" . GetCartId() . "', prod_name = $prod_name, item_desc = $item_desc'") or die(mysql_error());
		$row = mysql_fetch_row($result);
		$numRows = $row[0];

The variable string:

Code: 
$qty = $_REQUEST['qty'];
$first_color = $_REQUEST['first_color'];
$second_color = $_REQUEST['second_color'];
$warranty = $_REQUEST['warranty'];
$item_desc = echo "'$first_color . ' | ' . $second_color . ' | ' . $warranty'";
 
Jadenrose said:
The query:

Code: 
$result = mysql_query("select count(*) from cart where cookieId = '" . GetCartId() . "', prod_name = $prod_name, item_desc = $item_desc'") or die(mysql_error());
		$row = mysql_fetch_row($result);
		$numRows = $row[0];
Click to expand...

There are a few things wrong with that query. I'm assuming the $prod_name is a string which needs to be wrapped in single quotes. There is also an extra single quote after $item desc. When I said echo the query string, I meant echo what you were passing into the mysql_query function. For example
Code: 
$query = "select count(*) from cart where cookieId = '" . GetCartId() . "', prod_name = '$prod_name', item_desc = '$item_desc' ";

echo $query;

Execute that code and copy the output string for us.
 
Jadenrose said:
The query:

Code: 
$result = mysql_query("select count(*) from cart where cookieId = '" . GetCartId() . "', prod_name = $prod_name, item_desc = $item_desc'") or die(mysql_error());
		$row = mysql_fetch_row($result);
		$numRows = $row[0];
Click to expand...

Two problems:

1) You need "AND" (or possibly "OR", depending on the logic), not a comma, to connect the conditions of the WHERE clause.

2) You need to escape and quote the PHP variables that are being interpolated in the MySQL query by using mysql_escape_string() or, preferably, mysql_real_escape_string(). See http://us.php.net/manual/en/function.mysql-real-escape-string.php for documentation. In fact, it is a big security hole not to do this (because someone could inject arbitrary SQL.code into the input.

Example of escaping/quoting:

Code: 
$escaped_prod_name = mysql_real_escape_string($prod_name);
$result = mysql_query("select ... where prod_name = '$escaped_prod_name' ...");
 
Thanks you guys for that help. With your suggestions, I managed to find the problem and get it worked out. I have come up now iwth an issue on it not inserting records into the database. Here's the code, if you're still willing to help. :):

Code: 
// Check if this item already exists in the users cart table
		$escaped_prod_name = mysql_real_escape_string($prod_name);
		$result = mysql_query("select count(*) from cart where cookieId = '" . GetCartId() . "', prod_name = '$escaped_prod_name' and item_desc = '$item_desc'");
		echo $query;
		$row = mysql_fetch_row($result);
		$numRows = $row[0];
		
		if($numRows == 0)
		{
			// This item doesn't exist in the users cart,
			// we will add it with an insert query

			@mysql_query("INSERT INTO cart (cookieId, prod_name, qty, item_desc) VALUES ('" . GetCartId() . "', 'prod_name', 'qty', 'item_desc')") or die(mysql_error());

Its probably something easy..but I've been staring at it too long I think and don't see it. /sigh
 
You are inserting the strings 'prod_name', 'qty', and 'item_desc' instead of what is contained in those variables. It should be '$prod_name', '$qty', '$item_desc'.

Like I said before, if a query isn't working the way you think it does or if it is throwing an error, print out the query string to see what you are passing into mysql_query.
 
It wasn't printing anything out. I was probably doing that string wrong, but it would just load the cart, no errors. Even the or die wouldn't kick anything out. It just didn't insert anything into the db. Changed them all to variables and still nothing, not printing anything out. Never dealt much with printing an @mysql_query so its probably me doing something wrong. Code as it stands now:

Code: 
if($numRows == 0)
	{
		// This item doesn't exist in the users cart,
		// we will add it with an insert query

		@mysql_query("INSERT INTO cart (cookieId, prod_name, qty, item_desc) VALUES ('" . GetCartId() . "', '$prod_name', '$qty', '$item_desc')") or die(mysql_error());
			print @query;
 
Yes. We know it's not printing anything out. We're asking you to do something like:
Code: 
$query = "magical SQL stuff here";
echo $query;
mysql_query($query);

And get rid of those @ symbols. Silent Error suppression is the worst PHP feature period. Handle or get rid of the errors - don't pretend they don't exist.
 
Silent Error..figures. Someone suggested I try it to. Remind me to go and beat them with a stick, k?

And, I changed it to what you suggest. No info is being sent to the db, as well as, no echo string to show what its passing.

Code: 
$query = "INSERT INTO cart (cookieId, prod_name, qty, item_desc) VALUES ('" . GetCartId() . "', $prod_name, $qty, $item_desc)" or die(mysql_error());
echo $query;
mysql_query($query);
 
Try this code to see your output


PHP: 
error_reporting(E_ALL);

$query = "INSERT INTO cart (cookieId, prod_name, qty, item_desc) VALUES ('" . GetCartId() . "', '$prod_name', $qty, '$item_desc')" ;

echo $query;

mysql_query($query) or die(mysql_error());

Let me know if this works.
 
You must log in or register to reply here.
Back
Top