HTML/CSS/JS/ASP/PHP/SQL help/coding thread.

[Sk3tch]

I saw that nobody had done this except for the programming thread (which was centered at programs not websites) so I decided that this would prove as a useful thread for some. So this is a thread where you can post all website coding related discussions and “help needed” etc.

EDIT: Huge thanks to Flatline and Hyperbyte for helping me out.

[Flatline]

@Sk3tch

I saw that nobody had done this except for the programming thread (which was centered at programs not websites) so I decided that this would prove as a useful thread for some. So this is a thread where you can post all website coding related discussions and “help needed” etc.

So as a n00b coder I have begun learning PHP and SQL. I have a free test website where I did a test page. I have a problem with my SQL query page.
So I have an index page with a form.

[code]

What's your name and age?

First name: Last name: Age: [/code]

Then there is the form action page, welcome.php which I included only the PHP part because it’s causing the problem.

$con = "mysql_connect("$mysql_host","$mysql_user","$mysql_password");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }"
mysql_select_db("$mysql_database", $con);
mysql_query("INSERT INTO Persons (fname, lname, age)
VALUES ('$_POST['fname']', '$_POST['lname']', '$_POST['age']')");
mysql_close($con);
 

So as I said, I have a error with my SQL query. When I come to the page, it says “Parse error: syntax error, unexpected T_VARIABLE in /home/*/public_html/welcome.php on line 9”
Whats wrong with my code?

Try changing the double quotes in your POST variables to single quotes as the double quotes are not being escaped and probably causing problems. It’s been a while since I did PHP so I could be wrong.

[Hyperbyte]

$con = mysql_connect($mysql_host, $mysql_user, $mysql_password);
if (!$con)
  die('Could not connect: ' . mysql_error());

$fname = mysql_real_escape_string($_POST['fname']);
$lname = mysql_real_escape_string($_POST['lname']);
$age = mysql_real_escape_string($_POST['age']);

mysql_select_db($mysql_database, $con);
mysql_query("INSERT INTO Persons (fname, lname, age) VALUES ('$fname', '$lname', '$age')");
mysql_close($con);
 

I think that’s it. Please learn what the difference is between ’ and ", when you should which one, and especially when you shouldn’t use either of them. Also learn how to prevent SQL injections with mysql_real_escape_string.

Good luck!