Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #7470 > unrolled thread

Help required with UPDATE columns

Back to article view | Back to comp.lang.php

Contents

  Help required with UPDATE columns Dynamo - 2012-11-06 12:40 +0000
    Re: Help required with UPDATE columns Shake <QUITAESTO@QUITAESTO.NOES> - 2012-11-06 13:44 +0100
      Re: Help required with UPDATE columns Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-06 18:59 +0100
        Re: Help required with UPDATE columns Shake <QUITAESTO@QUITAESTO.NOES> - 2012-11-06 19:06 +0100
          Re: Help required with UPDATE columns Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-06 19:13 +0100
            Re: Help required with UPDATE columns Shake <QUITAESTO@QUITAESTO.NOES> - 2012-11-06 19:20 +0100
              Re: Help required with UPDATE columns "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-11-06 19:30 +0100
                Re: Help required with UPDATE columns Shake <QUITAESTO@QUITAESTO.NOES> - 2012-11-06 19:45 +0100
                  Re: Help required with UPDATE columns Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-06 19:57 +0100
                  Re: Help required with UPDATE columns "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-11-06 20:36 +0100
              Re: Help required with UPDATE columns Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-06 19:53 +0100
                Re: Help required with UPDATE columns Shake <alex.estevezQUENO@QUENOfilnet.es> - 2012-11-06 20:36 +0100
              Re: Help required with UPDATE columns Jerry Stuckle <jstucklex@attglobal.net> - 2012-11-06 15:02 -0500
      Re: Help required with UPDATE columns Dynamo - 2012-11-07 11:07 +0000
    Re: Help required with UPDATE columns Jerry Stuckle <jstucklex@attglobal.net> - 2012-11-06 08:15 -0500
      Re: Help required with UPDATE columns Dynamo - 2012-11-07 11:05 +0000
        Re: Help required with UPDATE columns Jerry Stuckle <jstucklex@attglobal.net> - 2012-11-07 07:07 -0500

#7470 — Help required with UPDATE columns

Hi,
I am experiencing problem with updating records in my table. The
following code works.
[
$query1 = ("UPDATE mytable SET drawing = 'mydrawing.pdf' WHERE id=2");
$result = mysql_query($query1) or die ("Error in query $query1" .
mysql_error()); 
mysql_close($connection);
]
but this does not
[
$drawing = $_POST['drawing'];
$query1 = ("UPDATE mytable SET drawing = $drawing WHERE id=2");
$result = mysql_query($query1) or die ("Error in query $query1" .
mysql_error()); 
mysql_close($connection);
]
The following error message appears when executing the second

[
Error in query: UPDATE mytable SET drawing=mydrawing.pdf WHERE id=2.
Unknown column 'mydrawing.pdf' in 'field list'
]

What am I doing wrong? Any help greatly appreciated.

TIA
Dynamo

[toc] | [next] | [standalone]

#7471

El 06/11/2012 13:40, Dynamo escribió:
> $query1 = ("UPDATE mytable SET drawing = 'mydrawing.pdf' WHERE id=2");
[...]
> $query1 = ("UPDATE mytable SET drawing = $drawing WHERE id=2");

-------------------------------------------^

There are no quotes.

Incorrect:
- $query1 = ("UPDATE mytable SET drawing = $drawing WHERE id=2");
correct:
- $query1 = ("UPDATE mytable SET drawing = '$drawing' WHERE id=2");


That's not a PHP problem. Is a SQL one.

Regards.

[toc] | [prev] | [next] | [standalone]

#7473

Shake wrote:

> El 06/11/2012 13:40, Dynamo escribió:
>> $query1 = ("UPDATE mytable SET drawing = 'mydrawing.pdf' WHERE id=2");
> [...]
>> $query1 = ("UPDATE mytable SET drawing = $drawing WHERE id=2");
> 
> -------------------------------------------^
> 
> There are no quotes.

Either one allows for SQL injection.  The OP should read on Prepared 
Statements (but at least mysql_real_escape_string()) instead.

> Incorrect:
> - $query1 = ("UPDATE mytable SET drawing = $drawing WHERE id=2");
> correct:
> - $query1 = ("UPDATE mytable SET drawing = '$drawing' WHERE id=2");

The parentheses are unnecessary and misleading.  The names should be 
backtick-quoted.
  
> That's not a PHP problem. Is a SQL one.

_MySQL_, and you do not appear to know either very well.


PointedEars
-- 
Danny Goodman's books are out of date and teach practices that are
positively harmful for cross-browser scripting.
  -- Richard Cornford, cljs, <cife6q$253$1$8300dec7@news.demon.co.uk> (2004)

[toc] | [prev] | [next] | [standalone]

#7474

El 06/11/2012 18:59, Thomas 'PointedEars' Lahn escribió:
> Shake wrote:
>
> Either one allows for SQL injection.  The OP should read on Prepared
> Statements (but at least mysql_real_escape_string()) instead.
[...]
> The parentheses are unnecessary and misleading.  The names should be
> backtick-quoted.
>
>> That's not a PHP problem. Is a SQL one.
>
> _MySQL_, and you do not appear to know either very well.

I just signaled the main error. That's doesn't mean I don't know very 
well. And, the error, isn't _MySQL_ The error is in the SQL sentence. 
And this sentence is wrong in MySQL... and in others SQL-DBs.

Rgds.

[toc] | [prev] | [next] | [standalone]

#7475

Shake wrote:

> El 06/11/2012 18:59, Thomas 'PointedEars' Lahn escribió:
>> Either one allows for SQL injection.  The OP should read on Prepared
>> Statements (but at least mysql_real_escape_string()) instead.
> [...]
>> The parentheses are unnecessary and misleading.  The names should be
>> backtick-quoted.
>>
>>> That's not a PHP problem. Is a SQL one.
>>
>> _MySQL_, and you do not appear to know either very well.
> 
> I just signaled the main error. That's doesn't mean I don't know very
> well. And, the error, isn't _MySQL_ The error is in the SQL sentence.
> And this sentence is wrong in MySQL... and in others SQL-DBs.

You are mistaken.  Whether the query is syntactically wrong in the DBMS 
depends on the data type, the value of the variable (that we do not know, do 
we?) and the query language.

The actual and much more grave issue here is that the OP is using user input 
($_POST['…']) unchecked and unescaped, which allows for SQL injection.  If 
they fixed that with Prepared Statements, both problems would go away.


PointedEars
-- 
    realism:    HTML 4.01 Strict
    evangelism: XHTML 1.0 Strict
    madness:    XHTML 1.1 as application/xhtml+xml
                                                    -- Bjoern Hoehrmann

[toc] | [prev] | [next] | [standalone]

#7476

El 06/11/2012 19:13, Thomas 'PointedEars' Lahn escribió:
>
> You are mistaken.  Whether the query is syntactically wrong in the DBMS
> depends on the data type, the value of the variable (that we do not know, do
> we?) and the query language.

You do not know. I know it.
Your limitations are not my mistake.

mytable.drawing values have to be enclosed by quotes.

>
> The actual and much more grave issue here is that the OP is using user input
> ($_POST['…']) unchecked and unescaped, which allows for SQL injection.  If
> they fixed that with Prepared Statements, both problems would go away.

Right. Still not a MySQL issue: An SQL issue.

Rgs.

[toc] | [prev] | [next] | [standalone]

#7477

Am 06.11.2012 19:20, schrieb Shake:
> El 06/11/2012 19:13, Thomas 'PointedEars' Lahn escribió:
>>
>> You are mistaken.  Whether the query is syntactically wrong in the DBMS
>> depends on the data type, the value of the variable (that we do not know, do
>> we?) and the query language.
> 
> You do not know. I know it.
> Your limitations are not my mistake.
> 
> mytable.drawing values have to be enclosed by quotes.
> 
>>
>> The actual and much more grave issue here is that the OP is using user input
>> ($_POST['…']) unchecked and unescaped, which allows for SQL injection.  If
>> they fixed that with Prepared Statements, both problems would go away.
> 
> Right. Still not a MySQL issue: An SQL issue.
> 

This sounds quite aggressive for someone showing so many coding problems. You could
have seen the sql error in your first posting.

/Str.

[toc] | [prev] | [next] | [standalone]

#7478

El 06/11/2012 19:30, M. Strobel escribió:
>
> This sounds quite aggressive for someone showing so many coding problems. You could
> have seen the sql error in your first posting.

I think you're confused, I am not the OP.

Rgrds.

[toc] | [prev] | [next] | [standalone]

#7480

Shake wrote:

> El 06/11/2012 19:30, M. Strobel escribió:
>> This sounds quite aggressive for someone showing so many coding problems.
>> You could have seen the sql error in your first posting.
> 
> I think you're confused, I am not the OP.

But you are equally confused (and equally address-munging)
as they are, so you have to give M. some credit here.


Score adjusted

PointedEars
-- 
When all you know is jQuery, every problem looks $(olvable).

[toc] | [prev] | [next] | [standalone]

#7482

Am 06.11.2012 19:45, schrieb Shake:
> El 06/11/2012 19:30, M. Strobel escribió:
>>
>> This sounds quite aggressive for someone showing so many coding problems. You could
>> have seen the sql error in your first posting.
> 
> I think you're confused, I am not the OP.
> 

Oops. Str.

[toc] | [prev] | [next] | [standalone]

#7479

Shake wrote:

> El 06/11/2012 19:13, Thomas 'PointedEars' Lahn escribió:
>> You are mistaken.  Whether the query is syntactically wrong in the DBMS
>> depends on the data type, the value of the variable (that we do not know,
>> do we?) and the query language.
> 
> You do not know. I know it.
> Your limitations are not my mistake.
> 
> mytable.drawing values have to be enclosed by quotes.

Oh shut up.  How can you possibly *know* the value of the variable $drawing 
when the OP has not posted it?  All you have is conjecture.

>> The actual and much more grave issue here is that the OP is using user
>> input
>> ($_POST['…']) unchecked and unescaped, which allows for SQL injection. 
>> If they fixed that with Prepared Statements, both problems would go away.
> 
> Right. Still not a MySQL issue: An SQL issue.

Bullshit.  It is obvious that the OP is using MySQL; so their MySQL syntax 
is at fault and their approach, too.


PointedEars
-- 
Anyone who slaps a 'this page is best viewed with Browser X' label on
a Web page appears to be yearning for the bad old days, before the Web,
when you had very little chance of reading a document written on another
computer, another word processor, or another network. -- Tim Berners-Lee

[toc] | [prev] | [next] | [standalone]

#7481

Thomas 'PointedEars' Lahn a couché sur son écran :
>
> Oh shut up.  How can you possibly *know* the value of the variable $drawing 
> when the OP has not posted it?  All you have is conjecture.

No. Is more than that. OP have not put the $drawing value explicitly. 
OP have put the $drawing value implicitly. You can argue a lot of 
hipotetical posibilities, but is obvious that $drawing have to by 
enclosed with quotes.

But... anyway:
>
> Bullshit.  It is obvious that the OP is using MySQL; so their MySQL syntax 
> is at fault and their approach, too.

No, using your arguments: all you have is a conjecture. OP could be not 
using MySQL.

And... anyway again: No matters what SQL Db is using... the error was 
on the SQL sentence, and was a generic SQL error. Not a MySQL specific.

Rgds.

[toc] | [prev] | [next] | [standalone]

#7483

On 11/6/2012 1:20 PM, Shake wrote:
> El 06/11/2012 19:13, Thomas 'PointedEars' Lahn escribió:
>>

"Pointed Head" is a well known troll in this and several other 
newsgroups.  Please don't feed him.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#7485

On Tue, 06 Nov 2012 13:44:27 +0100, Shake <QUITAESTO@QUITAESTO.NOES>
wrote:

>El 06/11/2012 13:40, Dynamo escribió:
>> $query1 = ("UPDATE mytable SET drawing = 'mydrawing.pdf' WHERE id=2");
>[...]
>> $query1 = ("UPDATE mytable SET drawing = $drawing WHERE id=2");
>
>-------------------------------------------^
>
>There are no quotes.
>
>Incorrect:
>- $query1 = ("UPDATE mytable SET drawing = $drawing WHERE id=2");
>correct:
>- $query1 = ("UPDATE mytable SET drawing = '$drawing' WHERE id=2");
>
>
>That's not a PHP problem. Is a SQL one.
>
>Regards.

Thanks Shake. That worked. Will digest other comments in the post
later.

Regards
Dynamo

[toc] | [prev] | [next] | [standalone]

#7472

On 11/6/2012 7:40 AM, Dynamo wrote:
> Hi,
> I am experiencing problem with updating records in my table. The
> following code works.
> [
> $query1 = ("UPDATE mytable SET drawing = 'mydrawing.pdf' WHERE id=2");
> $result = mysql_query($query1) or die ("Error in query $query1" .
> mysql_error());
> mysql_close($connection);
> ]
> but this does not
> [
> $drawing = $_POST['drawing'];
> $query1 = ("UPDATE mytable SET drawing = $drawing WHERE id=2");
> $result = mysql_query($query1) or die ("Error in query $query1" .
> mysql_error());
> mysql_close($connection);
> ]
> The following error message appears when executing the second
>
> [
> Error in query: UPDATE mytable SET drawing=mydrawing.pdf WHERE id=2.
> Unknown column 'mydrawing.pdf' in 'field list'
> ]
>
> What am I doing wrong? Any help greatly appreciated.
>
> TIA
> Dynamo
>

Echo your query to the browser and you'll see what your problem is.

And BTW - just taking a POST value without any validation is an 
invitation to problems.  Also, you should always use 
mysql_real_escape_string() to escape strings before they are used in SQL 
statements.

And finally - never use die() in production code!  It's OK for 
debugging, but terminates processing of the page right there - causing 
invalid HTML to be sent to the browser and sends a non-user-friendly 
message (which can give out hints on how to hack your system).

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#7484

On Tue, 06 Nov 2012 08:15:32 -0500, Jerry Stuckle
<jstucklex@attglobal.net> wrote:


>
>Echo your query to the browser and you'll see what your problem is.
>
>And BTW - just taking a POST value without any validation is an 
>invitation to problems.  Also, you should always use 
>mysql_real_escape_string() to escape strings before they are used in SQL 
>statements.
>
>And finally - never use die() in production code!  It's OK for 
>debugging, but terminates processing of the page right there - causing 
>invalid HTML to be sent to the browser and sends a non-user-friendly 
>message (which can give out hints on how to hack your system).

Thank you Jerry. Shakes solution worked but I will bear your comments
in mind. However, the code is being used in a password protected area
that theoretically only I should have access to.

Regards
Dynamo

[toc] | [prev] | [next] | [standalone]

#7486

On 11/7/2012 6:05 AM, Dynamo wrote:
> On Tue, 06 Nov 2012 08:15:32 -0500, Jerry Stuckle
> <jstucklex@attglobal.net> wrote:
>
>
>>
>> Echo your query to the browser and you'll see what your problem is.
>>
>> And BTW - just taking a POST value without any validation is an
>> invitation to problems.  Also, you should always use
>> mysql_real_escape_string() to escape strings before they are used in SQL
>> statements.
>>
>> And finally - never use die() in production code!  It's OK for
>> debugging, but terminates processing of the page right there - causing
>> invalid HTML to be sent to the browser and sends a non-user-friendly
>> message (which can give out hints on how to hack your system).
>
> Thank you Jerry. Shakes solution worked but I will bear your comments
> in mind. However, the code is being used in a password protected area
> that theoretically only I should have access to.
>
> Regards
> Dynamo
>

Dynamo, it really doesn't matter if only you "should" have access to it. 
  Hackers gain "protected" access to sites every day.  You really need 
to protect yourself against them.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.php

csiph-web