1

I tried to make a login API for something but I got a MySQL error And I do not know how to fix it. This is the error

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '''' at line 1

Can someone help me out? Also if you have a better suggestion or script / framework / etc to build this API link me it cause I need a API for user managemant with own fields.

This is my code:

<?php 
    include ('config.php');

    $con = mysqli_connect(HOST, USER, PASS, NAME) or die("Error " . mysqli_error($link)); 
    if(!isset($_GET["id"]))
    {
        /*
            @ Login or Register
            @ api.php?set=[Login/Register]&...
        */
        if(isset($_GET["set"]))
        {
            $set = $_GET["set"];
            if($set == "register")
            {
                if(isset($_GET["username"]))
                {
                    if(isset($_GET["password"]))
                    {
                        if(isset($_GET["email"]))
                        {
                            $username = mysqli_escape_string($con, $_GET["username"]);
                            $password = mysqli_escape_string($con, $_GET["password"]);
                            $email = mysqli_escape_string($con, $_GET["email"]);

                            $query_cmd = mysqli_query($con, "SELECT * FROM users WHERE username='$username'");
                            $query_exe = mysqli_fetch_array($query_cmd);
                            $rows = mysqli_num_rows($query_cmd);
                            if(!$rowcount == 1)
                            {
                                $query_cmd = mysqli_query($con, "SELECT * FROM users WHERE email='$email'");
                                $query_exe = mysqli_fetch_array($query_cmd);
                                $rows = mysqli_num_rows($query_cmd);
                                if(!$rowcount == 1)
                                {
                                    $query_cmd = mysqli_query($con, "INSERT INTO users (id, username, password, email, ip, hwid, funds) VALUES ('" . $username . "','" . $password . "','" . $email . "','" . $_SERVER['REMOTE_ADDR'] . "'),'" . $_GET["hwid"] . "';");
                                    if ($query_cmd == false)
                                    {
                                        echo "Register failed: " . mysqli_error($con);
                                    }
                                    else
                                    {
                                        echo "Registerd!";
                                    }
                                } else {
                                    echo "Email already in use";
                                }
                            } else {
                                echo "Username already in use";
                            }
                        }
                    }
                }
            } else if($set == "login")
            {
                if(isset($_GET["username"]))
                {
                    if(isset($_GET["password"]))
                    {
                        $username = mysqli_escape_string($con, $_GET["username"]);
                        $password = mysqli_escape_string($con, $_GET["password"]);

                        $query_cmd = mysqli_query($con, "SELECT * FROM users WHERE username=$username");
                        $query_exe = mysqli_fetch_array($query_cmd);
                        $rows = mysqli_num_rows($query_cmd);
                        if($rowcount == 1)
                        {
                            if($password != $query['password'])
                            {
                                echo'Wrong password';
                            } else {
                                echo 'Successful login';
                            }
                        } else {
                            echo "Account does not exists";
                        }
                    }
                }
            } else {
                echo "This is not a valid account option";
            }

        } else {
            echo "This is not a valid API option";
        }
    } else {
        // Gather information
    }

    mysqli_close($con);
?>
6
  • 1
    How did this get two upvotes? They don't show the query or even tell us which one of them it is!
    – John Conde
    Apr 16, 2015 at 17:39
  • Show the query I do not know wich query is the problem.... Lookup the code there are 2 or 3 of them. Apr 16, 2015 at 17:41
  • 1
    The login 'API' isn't using the quoted version of username
    – Vinbot
    Apr 16, 2015 at 17:41
  • You should be able to figure this out easily. It's basic troubleshooting.
    – John Conde
    Apr 16, 2015 at 17:43
  • 1
    Remove queries until you stop getting the error. The last query removed is the broken one
    – John Conde
    Apr 16, 2015 at 17:57

1 Answer 1

2

There are a few errors in your code, and one of them is here, in your last query:

WHERE username=$username");

$username needs to be wrapped in quotes, it's a string.

WHERE username='$username'");

You also have an error in the INSERT query -

"INSERT INTO users (id, username, password, email, ip, hwid, funds) VALUES ('" . $username . "','" . $password . "','" . $email . "','" . $_SERVER['REMOTE_ADDR'] . "'),'" . $_GET["hwid"] . "';"

You specify 7 columns but only 5 insert values. (Why is the ) in the middle of the query? That is one syntax error all by itself.


Additional edit:

This line has a misplaced bracket:

$query_cmd = mysqli_query($con, 
"INSERT INTO users (id, username, password, email, ip, hwid, funds)
 VALUES 
 ('" . $username . "','" . $password . "','" . $email . "',
 '" . $_SERVER['REMOTE_ADDR'] . "'),'" . $_GET["hwid"] . "';");
                                  ^ there

Which should read as:

$query_cmd = mysqli_query($con, 
"INSERT INTO users (id, username, password, email, ip, hwid, funds) 
VALUES ('" . $username . "','" . $password . "','" . $email . "',
'" . $_SERVER['REMOTE_ADDR'] . "','" . $_GET["hwid"] . "')");

However, as Jay outlined in his edit (thank you Jay), you have 7 columns but only 5 insert values.

Therefore you will need to add the ones that are either missing or too many.

  • The ones that are missing in the query are for "id" and "funds".

N.B.:

Now, if "id" is an auto_increment, you can add '' in VALUES ('', '" . $username . "', including the variable for "funds" which doesn't appear to be in your question.

3
  • Still he gives the same. I try to find it but I cannot get into it! Apr 16, 2015 at 17:43
  • @JoeydeVries That is one error. What Vlad Bardalez says in their answer could also be another reason. So, fix both of those. Apr 16, 2015 at 17:47
  • @JoeydeVries Reload my answer and read it in its entirety. There are other reasons why it's failing and you will need to go over your code as to what should be in that query or not. Apr 16, 2015 at 18:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.