Click here to Skip to main content
15,895,142 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
You have an error in your sql syntax check the manual that corresponds to your MariaDB server version for the right syntax to use near "at line 7


I am building a site to publish an article and after composing am article in attempt post and review I encountered error above

What I have tried:

<pre>Cms_review_article.php

<?php
require 'db.inc.php';
require 'cms_output_functions.inc.php';
include 'cms_header.inc.php';

$db = mysql_connect(MYSQL_HOST, MYSQL_USER, MYSQL_PASSWORD) or
die ('Unable to connect. Check your connection parameters.');

mysql_select_db(MYSQL_DB, $db) or die(mysql_error($db));

$article_id = (isset($_GET['article_id']) && ctype_digit($_GET['article_id'])) ? $_GET['article_id'] : '';

echo '<h2> Article Review </h2>';
output_story($db, $article_id);

$sql = 'SELECT
is_published, UNIX_TIMESTAMP(publish_date) AS publish_date,
access_level
FROM
cms_articles a INNER JOIN cms_users u ON a.user_id = u.user_id
WHERE
article_id = ' . $article_id;
$result = mysql_query($sql, $db) or die(mysql_error());

$row = mysql_fetch_array($result);
extract($row);
mysql_free_result($result);

if (!empty($date_published) and $is_published) {
    echo '<h4> Published: ' . date('l F j, Y H:i', $date_published) . ' </h4> ';
}
?>
<form method="post" action="cms_transact_article.php">
<div>
<input type="submit" name="action" value="Edit"/>
<?php
if ($access_level > 1 || $_SESSION['access_level'] > 1) {
if ($is_published) {
echo ' <input type="submit" name="action" value="Retract"/> ';
} else {
echo ' <input type="submit" name="action" value="Publish"/> ';
echo '<input type="submit" name="action" value="Delete"/> ';
}
}
?>
<input type="hidden" name="article_id" value=" <?php echo $article_id; ?> "/>
</div>
</form>
<?php
include 'cms_footer.inc.php';
?>
Posted
Updated 3-Jan-19 16:04pm
Comments
Richard MacCutchan 3-Jan-19 5:30am    
What is the text of the SQL statement that causes the error?
ZurdoDev 3-Jan-19 13:43pm    
This is very simple to fix. Do what the error tells you to do.

1 solution

Based on the error message, very likely the $article_id is empty. you can verify it by replacing the $article_id with an integer and run the application again.

Your code could be vulnerable to SQL injection. Here you can read more about SQL Injection vulnerability.
SQL Injection and Cross-Site Scripting[^]
 
Share this answer
 
Comments
Maciej Los 4-Jan-19 8:20am    
5ed!
Bryian Tan 4-Jan-19 12:21pm    
thanks :)

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900