Help please, I can't understand the error with this code

Question

leto-hostes.com 0 Newbie Poster

16 Years Ago

<?php
$con = mysql_connect('localhost', 'leto_hostes', 'password_hidden');
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("letohost_player", $con);

$sql="INSERT INTO `letohost_user`.`player` (`USER_ID` ,`USERNAME` ,`PASSWORD` ,`EMAIL` ,`POSITION` ,`ACTIVE` ,`MEMBER` )
VALUES (NULL , '$_POST[register_username]', 'md5($_POST[register_password])', '$_POST[register_email]', '0', '0', '0');)";

if (!mysql_query($sql,$con))
  {
  die('Error: ' . mysql_error());
  }
echo "1 record added";

mysql_close($con)
?>

php

4 Contributors
10 Replies
191 Views
2 Days Discussion Span
Latest Post 16 Years Ago Latest Post by Member #120589

Dani AI

Generated 6 Months Ago

Quick diagnosis and where the thread was heading: the runtime errors come from malformed PHP string interpolation plus stray punctuation inside the SQL string (extra closing paren/semicolon and a quoted function call). was right that complex (curly) interpolation fixes some parsing issues, and ’s suggestion to compute the password hash beforehand is a useful debugging step — but the safer, more future‑proof approach is to stop using the old mysql_* API (it’s deprecated/removed) and use parameterized queries (PDO or MySQLi) to avoid both parse errors and SQL injection. (php.net)

A minimal, practical pattern to follow (validate input, hash the password in PHP, then use a prepared statement) — note: this is a different example than the code already posted in the thread:

<?php
$username = trim($_POST['register_username'] ?? '');
$email    = trim($_POST['register_email'] ?? '');
$password = $_POST['register_password'] ?? '';

if (!filter_var($email, FILTER_VALIDATE_EMAIL)) exit('bad email');

$hash = password_hash($password, PASSWORD_DEFAULT);

$pdo = new PDO('mysql:host=localhost;dbname=your_db;charset=utf8mb4','dbuser','dbpass', [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
]);

$stmt = $pdo->prepare('INSERT INTO player (USERNAME, PASSWORD, EMAIL, POSITION, ACTIVE, MEMBER)
                       VALUES (:u, :p, :e, :pos, :act, :mem)');
$stmt->execute([
    ':u'   => $username,
    ':p'   => $hash,
    ':e'   => $email,
    ':pos' => 0, ':act' => 0, ':mem' => 0
]);
?>

Prepared statements remove the need to build values into the SQL string and guard against injection; see PDO prepared statements for details. (php.net)

If you still see parse errors while editing, it usually means a broken quoted string or incorrect interpolation (missing/extra braces, unquoted array keys) — the PHP string interpolation docs explain the complex (curly) syntax and why a malformed double‑quoted string triggers those parser errors. For quick debugging echo/var_dump the PHP variables, use try/catch around PDO to see the exception message, and copy the resulting SQL/values into your DB GUI to test. (php.net)

Security note: do not use MD5 for password storage — use password_hash() / password_verify() and give the password column enough space (hashes can exceed 60 chars). OWASP also recommends modern password algorithms (Argon2/bcrypt) rather than legacy MD5/SHA1. (php.net)

All 10 Replies

Member #120589

16 Years Ago

Yes EE.

$sql="INSERT INTO `letohost_user`.`player` (`USER_ID` ,`USERNAME` ,`PASSWORD` ,`EMAIL` ,`POSITION` ,`ACTIVE` ,`MEMBER` )
VALUES (NULL , '$_POST[register_username]', 'md5($_POST[register_password])', '$_POST[register_email]', '0', '0', '0');)";

But LH, please use the correct syntax. Even with encased array vars, the array member should be quoted - either with single or double quotes:

"...{$_POST['register_password']}..."
OR
"...{$_POST[\"register_password\"]}..."
AND
"...{$_POST['register_email']}..."
OR
"...{$_POST[\"register_email\"]}..."

Edited 16 Years Ago by Member #120589 because: n/a

almostbob 866 Retired: passive income ROCKS

16 Years Ago

no quotes on table names column names

mysql_query("INSERT INTO Persons (FirstName, LastName, Age) VALUES ('Peter', 'Griffin', '35')");
// so
$sql="INSERT INTO letohost_user.player (USER_ID, USERNAME, PASSWORD, EMAIL, POSITION, ACTIVE, MEMBER) VALUES (NULL, {$_POST['register_username']}, {md5($_POST['register_password']}), {$_POST['register_email']}, '0', '0', '0');)";

http://www.w3schools.com/php/php_mysql_insert.asp

Edited 16 Years Ago by almostbob because: n/a

almostbob 866 Retired: passive income ROCKS

16 Years Ago

not added, example code only

read the link provided to find the correct format and edit your code

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

leto-hostes.com 0 Newbie Poster · Answer 1 · 2010-03-19T00:19:36+00:00

My error with this code when somebody tries to register is:

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ')' at line 2

ElegantElephant 0 Light Poster · Answer 2 · 2010-03-19T01:57:13+00:00

You need to encase your array variables with curly brackets like this:

'{$_POST[register_username]}'

leto-hostes.com 0 Newbie Poster · Answer 3 · 2010-03-20T03:36:43+00:00

Is it the same with the md5 variable? And thank you for the help on this script. I'm not that good when it comes to PHP and SQL.. How did i not use the right syntax? :S

leto-hostes.com 0 Newbie Poster · Answer 4 · 2010-03-20T05:34:06+00:00

Okay, After editting the script, i now recieve the error:

Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in /home/letohost/public_html/register.php  on line 11

line 11 new syntax:

$sql="INSERT INTO `letohost_user`.`player` (`USER_ID` ,`USERNAME` ,`PASSWORD` ,`EMAIL` ,`POSITION` ,`ACTIVE` ,`MEMBER` )
VALUES (NULL , {$_POST['register_username']}, {md5($_POST['register_password']}), {$_POST['register_email']}, '0', '0', '0');)";

leto-hostes.com 0 Newbie Poster · Answer 5 · 2010-03-20T19:40:26+00:00

I've added the script you wrote there and i'm still recieving the same error..

leto-hostes.com 0 Newbie Poster · Answer 6 · 2010-03-20T23:11:50+00:00

not added, example code only
read the link provided to find the correct format and edit your code

I've done that too and it still isn't working..

Member #120589 · Answer 7 · 2010-03-21T18:00:38+00:00

Notice you use VALUES syntax. I prefer the SET syntax so that I know everything (fields + values) match up. THis obviously has its limitations, but has saved hours in trying to disentangle my statements.

$sql="INSERT INTO letohost_user.player (USER_ID, USERNAME, PASSWORD, EMAIL, POSITION, ACTIVE, MEMBER) VALUES (NULL, {$_POST['register_username']}, {md5($_POST['register_password']}), {$_POST['register_email']}, '0', '0', '0');)";

BECOMES

$md5p = md5($_POST['register_password']); 

$sql="INSERT INTO letohost_user.player SET `USERNAME` = '{$_POST['register_username']}', `PASSWORD` = '$md5p', `EMAIL` = '{$_POST['register_email']}', `POSITION` = 0, `ACTIVE` = 0, `MEMBER` = 0";

I'm not saying that this is better, just an option. I usually echo out the statement to find any obvious errors:

echo $sql;

In addition, if I get an error, but can't see the issue, I'll paste the echoed statement into my DB GUI (sqlYOG or phpmyadmin) SQL box and run it there. I tweak the SQL manually until I get it to work before returning to the php for adjustments. Just my two-penneth worth.

Help please, I can't understand the error with this code

Dani AI

Recommended Answers Collapse Answers

All 10 Replies

Recommended Answers