Topic: Cant figure why this mysql giving me a errorr?

[monkuar]

Code: [Select]

for ($a=0;$a<$num;$a++)
    {
        $DB->query("INSERT INTO ibf_itemshop_inventory(productid,memberid,paid) VALUES( '". mysql_real_escape_string($product["productid"]) ."','". mysql_real_escape_string($ibforums->member["id"]) .",'". mysql_real_escape_string($product["price"]) ."')");
    }
im using mysql real escape against for hackers..

but it's giving me a error:





<sup>mySQL query error: INSERT INTO ibf_itemshop_inventory(productid,memberid,paid) VALUES( '10','1,'0')

mySQL error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '0')' at line 1
mySQL error code:
Date: Sunday 28th 2009f June 2009 07:29:54 AM</sup>

[Dj Kat]

just looking at the following query in your error it seems you forgot a single quote

INSERT INTO ibf_itemshop_inventory(productid,memberid,paid) VALUES( '10','1','0')

and btw if the id's are only suppose to be numbers/integers your better of checking if those values are indeed numbers/integers instead of using mysql_real_escape_string

[monkuar]

Is that security risk?

I use this:

for each variable
good enough?

Code: [Select]

$id = $ibforums->input["id"];
$num = $ibforums->input["num"];
if (isset($id)){
if (is_numeric($id)) {

} else {
die("Your ip has been saved in the Database and will be reported to your ISP.");
}
}
if (isset($num)){
if (is_numeric($num)) {

} else {
die("Your ip has been saved in the Database and will be reported to your ISP.");
}
}
my code is from 2002 but i enchance it alittle each time

[wildteen88]

Having empty if statements is pointless. You're better of doing

if (isset($ibforums->input["id"], $ibforums->input["num"])) {
    if(!is_numeric($ibforums->input["id"]) && !is_numeric($ibforums->input["num"])) {
        die("Your ip has been saved in the Database and will be reported to your ISP.");
   }

   $id = $ibforums->input["id"];
   $num = $ibforums->input["num"];
}

[GingerRobot]

Learn something new every day. I didn't know isset() could take a variable number of arguments.