CODEWITHSUNDEEP
phpsqlphpmyadmin
tetris
tetris

Reputation: 4362

strange sql error

i have the following code:

<!--ajouter une carte     -->
<?php
if($_POST["submit_dd"]){

    mysql_query("INSERT INTO data SET desc='".$_POST["carte_nom"]."' ") or die(mysql_error());



 }
?>

<b>Ajouter une carte:</b><br>
<form method="post">
<table>
<tr><td>nom</td><td><textarea name="carte_nom"/></textarea></td></tr>
<tr><td></td><td><input type="submit" name="submit_dd" value="Ajouter"/></td></tr>
</table>
</form>

i get an error from this very simple query:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'desc='dsfgsdfds'' at line 1

the database is very simple: id(primary, auto increment), desc(text)

regards

Upvotes: 0

Views: 72

Answers (4)

Ramesh Soni
Ramesh Soni

Reputation: 16077

desc is a reserve keyword. Use "desc" instead

Upvotes: 1

Farray
Farray

Reputation: 8538

Check the list of reserved keywords. "DESC" is one of them.

The following is valid in MySQL:

INSERT INTO data SET `desc` = 'post data';

You should rethink your script though. Having fields named the same as reserved keywords is a bad sign. As is the lack of sanitation before using the $_POST data.

Here's why desc is an ugly fieldname:

SELECT id, desc
FROM data
ORDER BY id desc;  #this is valid sql, but likely isn't going to do what you expect

Which look very much like

SELECT id, desc
FROM data
ORDER BY id, desc;   #not valid sql

And the obligatory injection reading: How does the SQL injection from the "Bobby Tables" XKCD comic work?

Upvotes: 0

Brian Glaz
Brian Glaz

Reputation: 15686

I might be wrong, but you are probably getting an error because desc is a sql keyword. try wrapping it in back ticks `desc`

Upvotes: 4

Cliff
Cliff

Reputation: 1701

mysql_query("INSERT INTO data (desc) VALUES('".$_POST["carte_nom"].")' ")

Upvotes: 0

Related Questions