1

Okay, so I have a register.php script written and I get an unexpected T Variable when the command tries to execute. The error lies on line 15 at

('$_Post[username]','$_Post[sha_pass_hash]','$_Post[email]','2')";

I also have a second error in my syntax according to Dreamweaver at line 20 for

    die('Error: ' . mysql_error());

If anyone could help it would be greatly appreciated. Thank you in advance.

5 Answers 5

3

STOP

Inserting into a database directly from post is always a bad idea. This is the reason PHP is currently stuck with the very un-intuitive magic quotes.

You should at the very least be using mysql_real_escape_string() to escape your data. For example:

$link = mysql_connect('mysql_host', 'mysql_user', 'mysql_password')
OR die(mysql_error());

$query = "INSERT INTO users VALUES (
    '" . mysql_real_escape_string($_POST["username"]) . "',
    '" . mysql_real_escape_string($_POST["sha_pass_hash"]) . "',
    '" . mysql_real_escape_string($_POST["email"]) . "',
    '2'
)";

mysql_query($query);

The reason you have to do this is security based. For example if some malicious set the username field to '); DROP TABLE users; without first escaping your data. You would end up blindly running the following query:

INSERT INTO users VALUES (''); DROP TABLE users;

Which of course isn't going to end well for your application.

This is the minimum you should be doing.

In reality you should really be moving onto MySQLi Which is a much more modern MySQL interface. Here is an example

$mysqli = new mysqli('mysql_host', 'mysql_user', 'mysql_password', 'mysql_database');

$query = "INSERT INTO users VALUES (
    '" . $mysqli->real_escape_string($_POST["username"]) . "',
    '" . $mysqli->real_escape_string($_POST["sha_pass_hash"]) . "',
    '" . $mysqli->real_escape_string($_POST["email"]) . "',
    '2'
)";

$mysqli->query($query);

You can even use MySQL in a procedural style. So if Object orientated programing isn't with in your reach yet you will have no problems with MySQLi.

Hope that helps.

3
  • Okay, so right now I'm going off of your mysql_real_escape_string; currently I am still getting an error with yours as well as call to undefined function mysql_connect, but I am trying to sort through it; I'm told that it's from my php extensions not loading so as soon as I can get all that figured out then I'll be good to go and able to fix it to where it should work correctly. I've modded my php.ini and so now I think there's an underlying cause in my apache configuration. Sooner or later I'll have the solution and post it up for everyone. Thanks a lot for the tip; SQL Injection. new to me. Jul 10, 2012 at 20:49
  • I think I found the issue. I checked the syntax inside of CMD prompt and running apache -t it tells me Jul 11, 2012 at 2:24
  • Yes it sounds like you either don't have the MySQL module installed (windows) or didn't compile PHP with MySQL (linux). As i remember The old MySQL module isn't bundled with PHP anymore. You should probably save yourself the hassle and just use the MySQLi module.
    – Kinetic
    Jul 11, 2012 at 17:25
2
($_Post["username"],$_Post["sha_pass_hash"],$_Post["email"],'2')";

Remove the quotes..

1
($_POST["username"],$_POST["sha_pass_hash"],$_POST["email"],'2')";

Lose the single quotes around the variables :)

1
($_Post["username"],$_Post["sha_pass_hash"],$_Post["email"],'2')";
1

use this:

('".$_Post[username]."','".$_Post[sha_pass_hash]."','".$_Post[email]."','2')

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.