CODEWITHSUNDEEP
phpmysql
zeboidlund
zeboidlund

Reputation: 10137

SQL: username and password not recognized correctly

..of which I can't figure out what the exact problem is and/or why the interepreter is complaining about this. I'll post my code:

<?php

    $path = realpath(dirname(__FILE__));

    require("../data/userhandler.class.php");

    $db = connectViaPdo();
    //var_dump($db);

    $userHandler = new UserHandler($db);

    $username = $_POST['username'];
    $password = $_POST['password'];
    $email = $_POST['email'];
    $ip = $_SERVER['REMOTE_ADDR'];

    $query = "select username, password from users where ip = {$ip}";
    $stmt = $db->prepare($query);
    $result = $stmt->fetch();

    if(!$result)
    {
        $isBanned = $userHandler->checkIfBanned($ip);

        if (!$isBanned)
        {
            $query = "INSERT INTO users(username, password, ip, email) VALUES({$username}, {$password}, {$ip}, {$email})";
            $stmt = $db->prepare($query);
            $result = $stmt->execute();
        }
        else
        {
            echo "You are BANNED from this server. Leave now and do not come back.";
            exit();
        }   
    }
    else
    {
        $query = "UPDATE users SET username = {$username}, password = {$password}, email = {$email} WHERE ip = {$ip} ";
        $stmt = $db->prepare($query);
        $result = $stmt->execute();
    }


?>

My output resembles the following: 

Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '.193.239, [email protected])' at line 1' in /home/someuser/somedomain.com/portfolio/private_html/modules/register_user.script.php:29 Stack trace: #0 /home/someuser/somedomain.com/portfolio/private_html/modules/register_user.script.php(29): PDOStatement->execute() #1 {main} thrown in /home/someuser/somedomain.com/portfolio/private_html/modules/register_user.script.php on line 29

While I did follow the Stacktrace, it didn't really seem to help anything: my PDOstatement is correct.

Upvotes: 0

Views: 301

Answers (1)

Clive
Clive

Reputation: 36956

I think your string values need to be inside quotes:

$query = "INSERT INTO users(username, password, ip, email) VALUES('{$username}', '{$password}', '{$ip}', '{$email}')";

Upvotes: 4

Related Questions