CODEWITHSUNDEEP
phpandroidmysqlsql
Osama_Almaani
Osama_Almaani

Reputation: 916

Post data to mysql DB

I'am trying to send data from android as JSON to PHP in order to parse it and save in MySQL DB

this is the part of the PHP CODE

$JsonString = $_POST["DATA"];
$JsonData = json_decode($JsonString, TRUE);

$Add_First_Only = 0;
foreach ($JsonData['items'] as $item)
{
    $Order_ID = $item['Order_ID'];
    $Order_Row_Number = $item['Order_Row_Number'];
    $Order_Item_ID = $item['Order_Item_ID'];
    $Order_Course_ID = $item['Order_Course_ID'];
    $Order_Seat_No = $item['Order_Seat_No'];
    $Order_Row_Value_wo_Options = $item['Order_Row_Value_wo_Options'];
    $Order_Row_Value_with_options = $item['Order_Row_Value_with_options'];

if ($Add_First_Only == 0)
{
    $result = mysqli_query($con,
    "INSERT INTO order_items (Order_ID,Order_Row_Number,Order_Item_ID,Order_Course_ID,Order_Seat_No,Order_Row_Value_wo_Options, Order_Row_Value_with_options) 
    VALUES 
    (['$Order_ID'],['$Order_Row_Number'],['$Order_Item_ID'],['$Order_Course_ID'],
        ['$Order_Seat_No'],['$Order_Row_Value_wo_Options'],['$Order_Row_Value_with_options'])"
    );
    $Add_First_Only = 1;
}
}

and this is the error I get on the Eclipse LogCAT

12-16 02:00:01.800: V/TAG(1841): Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '['26'],['1'],['1'],['1'],['1'],['0'],['1'])' at line 4

As you can see from the error it self that I have values for the variables so non of them is a null value

The Question is what should I change or add to my sql syntax to fix this error ?

Upvotes: 0

Views: 83

Answers (3)

Tomazi
Tomazi

Reputation: 781

When you use Single quotes '' around the data you want to INSERT into DB you tell PHP that this data is string type and your database probably expects INTEGER data.

Upvotes: 0

andrel
andrel

Reputation: 1154

Don't wrap the parameters in the SQL statemenst with square brackets (example: ['$Order_ID']).

I often find it helpful to echo or error_log the SQL statement that is created and try running it in a SQL tool. This should give you better error messages, and reveal syntax errors (if the tool has syntax highlighting).

Also, look at what php.net has to say about prepared statements. SQL-statements of this type are vulnerable to SQL-injection attacks which are one of the most common ways to attack systems.

Upvotes: 1

Funk Forty Niner
Funk Forty Niner

Reputation: 74217

Remove the brackets around ['$Order_ID'] and the others

Use '$Order_ID' instead of ['$Order_ID'] etc. for your VALUES

if ($Add_First_Only == 0)
{
    $result = mysqli_query($con,
    "INSERT INTO order_items (Order_ID,Order_Row_Number,Order_Item_ID,Order_Course_ID,Order_Seat_No,Order_Row_Value_wo_Options, Order_Row_Value_with_options) 
    VALUES 
    ('$Order_ID','$Order_Row_Number','$Order_Item_ID','$Order_Course_ID',
        '$Order_Seat_No','$Order_Row_Value_wo_Options','$Order_Row_Value_with_options')"
    );
    $Add_First_Only = 1;
}

Upvotes: 1

Related Questions