Tell me more ×
Stack Overflow is a question and answer site for professional and enthusiast programmers. It's 100% free, no registration required.
up vote 0 down vote favorite

I have contact form at my wordpress site which is delivered by ajax, and sent to my mail. I also wanted to save the results in a database so I wrote this query, but it gives me and syntax error, but I can't find anything wrong in this code:

<?php 
$con = mysql_connect("localhost","username","password");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("u31272B3", $con);

$sql="INSERT INTO wp_contactform (Nimi, Puhelin, E-mail, Viesti, IP, Day)
VALUES
('$_POST[Nimi]','$_POST[Puhelin]','$_POST[Sposti]','$_POST[Tiedot]','$_POST[Gotcha]','$_POST[Day]')";

if (!mysql_query($sql,$con))
  {
  die('Error: ' . mysql_error());
  }
echo "1 record added";

mysql_close($con);

?>

The jquery script that sends it works, and the mail is sent, but this doesn't save.

share|improve this question
What error are you getting? – Dainis Abols Jul 19 '12 at 14:36
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '-mail, Viesti, IP, Day) VALUES ('','','','','93.106.57.85','19072012')' at line 1 – Christian Jul 19 '12 at 14:37
1  
Don't construct SQL strings in this way, you open yourself up to SQL injection attacks. – David M Jul 19 '12 at 14:38
1  
@Christian Nikkanen Seems like MySQL doesn't like the - character in your column name. Change it or use backticks. – Gerald Versluis Jul 19 '12 at 14:39
How they should be constructed then? – Christian Jul 19 '12 at 14:39
show 1 more comment

4 Answers

up vote 4 down vote accepted

Quote the column name E-mail with backticks (`). MySQL is interpreting this in two parts at the moment.

Note also, (as per my comment) that your code is wide open to SQL injection attacks. It is much better to use properly parameterised SQL queries.

SQL injection example:

"INSERT INTO table (field) VALUE ('$_POST[var]')"

If you post the value "'; DROP TABLE table; --" then you have a valid SQL string that inserts an empty string, then attempts to drop the table. Substitute whatever harmful statement you want.

share|improve this answer
Oh, but when I echo the data out, I use htmlspecialchars? Isn't that enough to stop all possible attacks? – Christian Jul 19 '12 at 14:43
No. An apostrophe isn't a special character, and this is the start of most common SQL injection attacks. And in any event, do you really want HTML encoded stuff in your database? – David M Jul 19 '12 at 14:44
htmlentities then? and how does the aposthrophe start the attack? – Christian Jul 19 '12 at 14:48
Will edit explanation into answer - slightly lengthy... – David M Jul 19 '12 at 14:49
Oh s***. So how I can protect the database from these? – Christian Jul 19 '12 at 14:52
show 3 more comments
up vote 2 down vote

and also you should use mysql_real_escape_string() or prepared statements. if your query data have any special characters it can blow your query it also help you from sql injection too.

http://php.net/mysql_real_escape_string http://php.net/pdo

share|improve this answer
up vote 1 down vote

Your SQL request should be written as below:

$sql = "INSERT INTO wp_contactform (`Nimi`, `Puhelin`, `E-mail`, `Viesti`, `IP`, `Day`)
        VALUES
        ('$_POST[Nimi]','$_POST[Puhelin]','$_POST[Sposti]','$_POST[Tiedot]','$_POST[Gotcha]','$_POST[Day]')"

SQL fields using non-alphanumeric characters have to be escaped with backticks (`)

share|improve this answer
up vote 1 down vote

This should work

<?php
$con = mysql_connect("localhost", "username", "password");
if(!$con){
    die('Could not connect: '.mysql_error());
}

mysql_select_db("u31272B3", $con);

$sql = "INSERT INTO wp_contactform (`Nimi`, `Puhelin`, `E-mail`, `Viesti`, `IP`, `Day`)
VALUES
('".mysql_real_escape_string($_POST['Nimi'])."','".
   mysql_real_escape_string($_POST['Puhelin'])."','".
   mysql_real_escape_string($_POST['Sposti'])."','".
   mysql_real_escape_string($_POST['Tiedot'])."','".
   mysql_real_escape_string($_POST['Gotcha'])."','".
   mysql_real_escape_string($_POST['Day'])."')";

if(!mysql_query($sql, $con)){
    die('Error: '.mysql_error());
}
echo "1 record added";

mysql_close($con);
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.