Member Avatar for Kligham

Hi,

The following script gives back bummer as print, so the storing to database hasn't worked. What is wrong?

<?php

function db_connect(){

	$connect = new MySQLi("localhost", "justinmijn_root", "***", "justinmijn_nba");

	// mysql_connect_errno() retourneert 0 als er geen fouten zijn
	if (!$connect || mysqli_connect_errno() != 0) {
		throw new Exception('Er kan geen connectie tot stand gebracht worden. De volgende fout heeft zich voorgedaan:' . mysqli_connect_errno().
		' ' . mysqli_connect_error() . '<br /><br /> Als zich dit blijft voordien, gelieve de site administrator te contacteren');
	} else {
		return $connect;
	}
}


$aantalsp1w = 1;
$aantalsp1l = 2;
$aantalsp1p = 3;
$aantalsp2l = 4;
$aantalsp2w = 5;
$aantalsp2p = 6;

$team = "Boston Terriers";
$experts = "timmi";
$season = "2007-2008";

$con = db_connect();

$sides = ("'" . $aantalsp1w . "-" . $aantalsp1l . "-" . $aantalsp1p);
$totals = ("'" . $aantalsp2w . "-" . $aantalsp2l . "-" . $aantalsp2p);

$query = $con->query("INSERT INTO nba (team,expert,season,sides,totals) VALUES ('$team', '$experts', '$season', '$sides', '$totals')");

if ($query){
	print("jippie");
}else{
	print("bummer");
}
?>

Grtz

Edited by Kligham because: n/a
  • 2 Contributors
  • 4 Replies
  • 122 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by Kligham

Dani AI

Generated

Good catch by — the INSERT failed because the values you built for the composite fields contained an extra leading quote, which produced malformed SQL. That kind of mistake is easy to make when you concatenate quotes into strings, and it also leaves code vulnerable to SQL injection. The reliable fix is to stop injecting quotes into values and use parameterized queries (or at minimum, remove the stray quotes and properly escape values).

Use a prepared statement and bind parameters so you never hand-build the quoted value list. For example:

$stmt = $con->prepare(
  "INSERT INTO nba (team, expert, season, sides, totals) VALUES (?, ?, ?, ?, ?)"
);
if (! $stmt) {
  throw new RuntimeException('Prepare failed: ' . $con->error);
}
$stmt->bind_param('sssss', $team, $experts, $season, $sides, $totals);
$stmt->execute();
if ($stmt->errno) {
  throw new RuntimeException('Execute failed: ' . $stmt->error);
}
$stmt->close();

Practical debugging tips:

  • Before running a query, inspect the final values you plan to insert (use error_log or var_dump during development) to spot stray characters.
  • Enable strict MySQLi errors during development with mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT) so failures throw exceptions and show meaningful traces.
  • Always check prepare() and execute() return values and examine ->error or ->errno when something goes wrong.
  • Call $con->set_charset('utf8') to avoid encoding surprises.

Design note: storing "w-l-p" in a single text column is brittle. For searchable, indexable data prefer separate INT columns (wins, losses, points) or, if a composite value is necessary, use JSON/MySQL JSON type so the structure is explicit and easier to query.

As discovered, removing the extra quotes fixed the immediate problem — using prepared statements will prevent similar issues in the future.

Recommended Answers

All 4 Replies

Member Avatar for ShawnCplus 
}else{
   print($con->error);
}
Edited by ShawnCplus because: n/a
Member Avatar for Kligham

This is the output:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1-2-3', ''5-4-6')' at line 1

Member Avatar for ShawnCplus

You don't need the leading "'" . when setting $sides and $totals.

Member Avatar for Kligham

Ouch, didn't looked at that. I normally used it to write it to copy it in excel.

Thanks!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.