Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #2807 > unrolled thread

Adding a record to a database

Back to article view | Back to comp.lang.php

Contents

  Adding a record to a database Charles <cchamb2@gmail.com> - 2011-08-15 05:35 -0700
    Re: Adding a record to a database Jerry Stuckle <jstucklex@attglobal.net> - 2011-08-15 08:46 -0400
    Re: Adding a record to a database JohnT <john@example.com> - 2011-08-15 13:45 +0000
    Re: Adding a record to a database A.Reader <anonymously@example.com> - 2011-08-15 14:11 -0400
      Re: Adding a record to a database sheldonlg <sheldonlg@thevillages.net> - 2011-08-15 21:02 -0400
        Re: Adding a record to a database Jerry Stuckle <jstucklex@attglobal.net> - 2011-08-15 21:50 -0400
          Re: Adding a record to a database Charles <cchamb2@gmail.com> - 2011-08-16 01:30 -0700
            Re: Adding a record to a database A.Reader <anonymously@example.com> - 2011-08-16 05:41 -0400
              Re: Adding a record to a database Jerry Stuckle <jstucklex@attglobal.net> - 2011-08-16 06:23 -0400
                Re: Adding a record to a database A.Reader <anonymously@example.com> - 2011-08-16 09:11 -0400
                  Re: Adding a record to a database Tim Streater <timstreater@greenbee.net> - 2011-08-16 14:51 +0100
                    Re: Adding a record to a database A.Reader <anonymously@example.com> - 2011-08-16 10:42 -0400
                      Re: Adding a record to a database Tim Streater <timstreater@greenbee.net> - 2011-08-16 16:58 +0100
                  Re: Adding a record to a database Jerry Stuckle <jstucklex@attglobal.net> - 2011-08-16 17:21 -0400
            Re: Adding a record to a database Jerry Stuckle <jstucklex@attglobal.net> - 2011-08-16 06:17 -0400
          Re: Adding a record to a database sheldonlg <sheldonlg@thevillages.net> - 2011-08-16 16:13 -0400
            Re: Adding a record to a database Jerry Stuckle <jstucklex@attglobal.net> - 2011-08-16 17:24 -0400

#2807 — Adding a record to a database

I'm trying to add a record to a database, and it's not working
properly.

The general thought is to call a data entry form, fill in the form,
and use the $_POST(array) process to pass the data from the form to a
php script that handles adding the record to the database.

The only trick part of the php script is using a hidden field to pass
the name of the data entry form to a SWITCH statement.  I'm trying to
keep the site directory uncluttered and the scripting organized, and I
understand this works.

I'm getting Error 500 as I test the script, so I think I have
something coded incorrectly in the script, or I have something
missing.  Other php-based web applications wrok fine, so I suspect I
have php correctly installed.

Here's the coding:

=====================

<?php

/* <!--  This starts the switch statement.  The variable passed to
control iteration
is the $_Push(switch) variable set in the first (hidden) field in a
data entry form.
The value contained in the variable is the case predicate

*/


switch ($_Push(switch)) {

/*======================================================*/

    case "cab_vehicle_data_entry_add_a_vehicle":



 $con = mysql_connect("*********","****","******");  <<These are fine
 if (!$con)
   {
   die('Could not connect: ' . mysql_error());
   }

mysql_select_db("taxicab", $con);

$sql="INSERT INTO
cab_vehicle (cab_vehicle_make, cab_vehicle_model,
cab_vehicle_edition,
cab_vehicle_month, cab_vehicle_year, cab_vehicle_VIN,
cab_vehicle_registration_number,
cab_vehicle_reg_exp_month, cab_vehicle_reg_exp_year,
cab_vehicle_pax_capacity,
cab_vehicle_cubic_feet_cargo, cab_vehicle_cargo_weight)

 VALUES

 
('$_POST[Make]','$_POST[Model]','$_POST[Edition]','$_POST[Month]','$_POST[year]',
'$_POST[VIN]','$_POST[Registration]','$_POST[reg_exp_month]','$_POST[reg_exp_year]',
'$_POST[pax_capacity]','$_POST[cargo_cubic_feet]','$_POST[cargo_weight_lbs]')";

if (!mysql_query($sql,$con))
   {
   die('Error: ' . mysql_error());
   }
 echo "1 record added";

mysql_close($con)

     break;

/*======================================================*/

/*     case "whatever"
         Next process subroutine
     break;
*/

/*======================================================*/

/*     case "whatever"
         Next process subroutine
     break;
*/

/*======================================================*/

/*     case "whatever"
         Next process subroutine
     break;
*/

/*======================================================*/

/*     case "whatever"
         Next process subroutine
     break;
*/

/*======================================================*/

/*     case "whatever"
         Next process subroutine
     break;
*/

/*======================================================*/

/*     case "whatever"
         Next process subroutine
     break;
*/

/*======================================================*/

/*     case "whatever"
         Next process subroutine
     break;
*/

/*======================================================*/

/*     case "whatever"
         Next process subroutine
     break;
*/


}


 ?>

[toc] | [next] | [standalone]

#2809

On 8/15/2011 8:35 AM, Charles wrote:
> I'm trying to add a record to a database, and it's not working
> properly.
>
> The general thought is to call a data entry form, fill in the form,
> and use the $_POST(array) process to pass the data from the form to a
> php script that handles adding the record to the database.
>
> The only trick part of the php script is using a hidden field to pass
> the name of the data entry form to a SWITCH statement.  I'm trying to
> keep the site directory uncluttered and the scripting organized, and I
> understand this works.
>

It is also very insecure and will can leave your site wide open to hackers.

> I'm getting Error 500 as I test the script, so I think I have
> something coded incorrectly in the script, or I have something
> missing.  Other php-based web applications wrok fine, so I suspect I
> have php correctly installed.
>

Enable errors and display them.  In your php.ini file for your test 
system you should have:

error_reporting=E_ALL // or E_ALL | E_NOTICE
display_errors=on

> Here's the coding:
>
> =====================
>
> <?php
>
> /*<!--  This starts the switch statement.  The variable passed to
> control iteration
> is the $_Push(switch) variable set in the first (hidden) field in a
> data entry form.
> The value contained in the variable is the case predicate
>
> */
>
>
> switch ($_Push(switch)) {
>

Where is $_Push(switch) coming from?  And BTW it should be 'switch'.

What is in the $_Push array?  I suspect it's empty.

> /*======================================================*/
>
>      case "cab_vehicle_data_entry_add_a_vehicle":
>
>
>
>   $con = mysql_connect("*********","****","******");<<These are fine
>   if (!$con)
>     {
>     die('Could not connect: ' . mysql_error());

Bad practice.  Handle the error - don't terminate the script with an 
error message.

>     }
>
> mysql_select_db("taxicab", $con);
>
> $sql="INSERT INTO
> cab_vehicle (cab_vehicle_make, cab_vehicle_model,
> cab_vehicle_edition,
> cab_vehicle_month, cab_vehicle_year, cab_vehicle_VIN,
> cab_vehicle_registration_number,
> cab_vehicle_reg_exp_month, cab_vehicle_reg_exp_year,
> cab_vehicle_pax_capacity,
> cab_vehicle_cubic_feet_cargo, cab_vehicle_cargo_weight)
>
>   VALUES
>
>
> ('$_POST[Make]','$_POST[Model]','$_POST[Edition]','$_POST[Month]','$_POST[year]',
> '$_POST[VIN]','$_POST[Registration]','$_POST[reg_exp_month]','$_POST[reg_exp_year]',
> '$_POST[pax_capacity]','$_POST[cargo_cubic_feet]','$_POST[cargo_weight_lbs]')";
>

Google for 'SQL Injection'.  Then see how a hacker could easily wipe out 
your database.

> if (!mysql_query($sql,$con))
>     {
>     die('Error: ' . mysql_error());

Same comment as before.

>     }
>   echo "1 record added";
>
> mysql_close($con)
>
>       break;
>
> /*======================================================*/
>
> /*     case "whatever"
>           Next process subroutine
>       break;
> */
>
> /*======================================================*/
>
> /*     case "whatever"
>           Next process subroutine
>       break;
> */
>
> /*======================================================*/
>
> /*     case "whatever"
>           Next process subroutine
>       break;
> */
>
> /*======================================================*/
>
> /*     case "whatever"
>           Next process subroutine
>       break;
> */
>
> /*======================================================*/
>
> /*     case "whatever"
>           Next process subroutine
>       break;
> */
>
> /*======================================================*/
>
> /*     case "whatever"
>           Next process subroutine
>       break;
> */
>
> /*======================================================*/
>
> /*     case "whatever"
>           Next process subroutine
>       break;
> */
>
> /*======================================================*/
>
> /*     case "whatever"
>           Next process subroutine
>       break;
> */
>
>
> }
>
>
>   ?>


So find your problem - then straighten out your code per the other 
comments I made above.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#2811

On Mon, 15 Aug 2011 05:35:37 -0700, Charles wrote:

> 
> 
> ('$_POST[Make]','$_POST[Model]','$_POST[Edition]','$_POST

Start here - you can't put complex variables in a string unless you quote 
them like:

('{$_POST[Make]}','{$_POST[Model]}','{$_POST[Edition]}',

However - you should not be putting these directly into the database.
You should first validate in the input, and then quote the strings to 
make them database safe:

('".mysql_real_escape_string($_POST[Make])."',

JohnT

[toc] | [prev] | [next] | [standalone]

#2815

On Mon, 15 Aug 2011 05:35:37 -0700 (PDT),
Charles <cchamb2@gmail.com> wrote:

>I'm trying to add a record to a database, and it's not working
>properly.
>
>The general thought is to call a data entry form, fill in the form,
>and use the $_POST(array) process to pass the data from the form to a
>php script that handles adding the record to the database.
>
>The only trick part of the php script is using a hidden field to pass
>the name of the data entry form to a SWITCH statement.  I'm trying to
>keep the site directory uncluttered and the scripting organized, and I
>understand this works.
>
>I'm getting Error 500 as I test the script, so I think I have
>something coded incorrectly in the script, or I have something
>missing.  Other php-based web applications wrok fine, so I suspect I
>have php correctly installed.
>
>Here's the coding:
>
>=====================
>
><?php
>
>/* <!--  This starts the switch statement.  The variable passed to
>control iteration
>is the $_Push(switch) variable set in the first (hidden) field in a
>data entry form.
>The value contained in the variable is the case predicate
>
>*/
>
>
>switch ($_Push(switch)) {
>
>/*======================================================*/
>
>    case "cab_vehicle_data_entry_add_a_vehicle":
>
>
>
> $con = mysql_connect("*********","****","******");  <<These are fine
> if (!$con)
>   {
>   die('Could not connect: ' . mysql_error());
>   }
>
>mysql_select_db("taxicab", $con);
>
>$sql="INSERT INTO
>cab_vehicle (cab_vehicle_make, cab_vehicle_model,
>cab_vehicle_edition,
>cab_vehicle_month, cab_vehicle_year, cab_vehicle_VIN,
>cab_vehicle_registration_number,
>cab_vehicle_reg_exp_month, cab_vehicle_reg_exp_year,
>cab_vehicle_pax_capacity,
>cab_vehicle_cubic_feet_cargo, cab_vehicle_cargo_weight)
>
> VALUES
>
> 
>('$_POST[Make]','$_POST[Model]','$_POST[Edition]','$_POST[Month]','$_POST[year]',
>'$_POST[VIN]','$_POST[Registration]','$_POST[reg_exp_month]','$_POST[reg_exp_year]',
>'$_POST[pax_capacity]','$_POST[cargo_cubic_feet]','$_POST[cargo_weight_lbs]')";
>
>if (!mysql_query($sql,$con))
>   {
>   die('Error: ' . mysql_error());
>   }
> echo "1 record added";
>
>mysql_close($con)
>
>     break;
>
>/*======================================================*/
>
>/*     case "whatever"
>         Next process subroutine
>     break;
>*/
>
>/*======================================================*/
>
>/*     case "whatever"
>         Next process subroutine
>     break;
>*/
>
>/*======================================================*/
>
>/*     case "whatever"
>         Next process subroutine
>     break;
>*/
>
>/*======================================================*/
>
>/*     case "whatever"
>         Next process subroutine
>     break;
>*/
>
>/*======================================================*/
>
>/*     case "whatever"
>         Next process subroutine
>     break;
>*/
>
>/*======================================================*/
>
>/*     case "whatever"
>         Next process subroutine
>     break;
>*/
>
>/*======================================================*/
>
>/*     case "whatever"
>         Next process subroutine
>     break;
>*/
>
>/*======================================================*/
>
>/*     case "whatever"
>         Next process subroutine
>     break;
>*/
>
>
>}
>
>
> ?>

I'll pass on some highly-useful advice I got when I was learning
to program, back during the last ice age:  make your code look
neat and clean.  There's no logical reason for that to make bugs
go away, but in fact it does.

Your program should have a structure something like this:

<?php 

	if ( ! connected( 'taxicabs', 'sometable' ) ) die() ;

	if ( valid( $_REQUEST ) )
	{
		$s = 'INSERT INTO taxicabs.sometable SET ' ;
		$s .= 'Make="'.$_REQUEST['Make'].'", ' ;  
		$s .= 'Model="'.$_REQUEST['Model'].'", ' ;
		// the other fields the same way

// note that it's just "Make", "Model", etc not 
// "cab_vehicle_make" etc.  because  if you don't already know
// that you're talking about taxis, not railway locomotives or 
// steamboats, you're in more 
// trouble than wordy fieldnames can ever fix

		if ( ! mysql_query( $s, $dblink ) )
			die( 'Could not create the new record '.
				' because '.mysql_error() ) ;
	}
	else die( 'That is not a valid request because '. 
	$val_errors ) ;

	// it needn't be "die()" when something goes wrong, 
	// it could be some recovery 
	// routine where you explain what the person should
	// do differently and give them another go.  Of course, if
	// it's that the server choked or got lost, then die() is '
	// perfectly appropriate.


// ----------------------------
function connected( $db, $table )
{
	global $dblink ;
	// the mysql connection stuff, returning true if it works, or
// complain about the problems and return false.
}
// ----------------------------
function valid( $a )
{
	global $val_errors = '' ;
	// your validation code.  If it passes your tests,
	// return true.  If not, concatenate the complaints into 
	// $val_errors and return false ;
}

?>

[toc] | [prev] | [next] | [standalone]

#2821

On 8/15/2011 2:11 PM, A.Reader wrote:
> On Mon, 15 Aug 2011 05:35:37 -0700 (PDT),
> Charles<cchamb2@gmail.com>  wrote:
>
>> I'm trying to add a record to a database, and it's not working
>> properly.
>>
>> The general thought is to call a data entry form, fill in the form,
>> and use the $_POST(array) process to pass the data from the form to a
>> php script that handles adding the record to the database.
>>
>> The only trick part of the php script is using a hidden field to pass
>> the name of the data entry form to a SWITCH statement.  I'm trying to
>> keep the site directory uncluttered and the scripting organized, and I
>> understand this works.
>>
>> I'm getting Error 500 as I test the script, so I think I have
>> something coded incorrectly in the script, or I have something
>> missing.  Other php-based web applications wrok fine, so I suspect I
>> have php correctly installed.
>>
>> Here's the coding:
>>
>> =====================
>>
>> <?php
>>
>> /*<!--  This starts the switch statement.  The variable passed to
>> control iteration
>> is the $_Push(switch) variable set in the first (hidden) field in a
>> data entry form.
>> The value contained in the variable is the case predicate
>>
>> */
>>
>>
>> switch ($_Push(switch)) {
>>
>> /*======================================================*/
>>
>>     case "cab_vehicle_data_entry_add_a_vehicle":
>>
>>
>>
>> $con = mysql_connect("*********","****","******");<<These are fine
>> if (!$con)
>>    {
>>    die('Could not connect: ' . mysql_error());
>>    }
>>
>> mysql_select_db("taxicab", $con);
>>
>> $sql="INSERT INTO
>> cab_vehicle (cab_vehicle_make, cab_vehicle_model,
>> cab_vehicle_edition,
>> cab_vehicle_month, cab_vehicle_year, cab_vehicle_VIN,
>> cab_vehicle_registration_number,
>> cab_vehicle_reg_exp_month, cab_vehicle_reg_exp_year,
>> cab_vehicle_pax_capacity,
>> cab_vehicle_cubic_feet_cargo, cab_vehicle_cargo_weight)
>>
>> VALUES
>>
>>
>> ('$_POST[Make]','$_POST[Model]','$_POST[Edition]','$_POST[Month]','$_POST[year]',
>> '$_POST[VIN]','$_POST[Registration]','$_POST[reg_exp_month]','$_POST[reg_exp_year]',
>> '$_POST[pax_capacity]','$_POST[cargo_cubic_feet]','$_POST[cargo_weight_lbs]')";
>>
>> if (!mysql_query($sql,$con))
>>    {
>>    die('Error: ' . mysql_error());
>>    }
>> echo "1 record added";
>>
>> mysql_close($con)
>>
>>      break;
>>
>> /*======================================================*/
>>
>> /*     case "whatever"
>>          Next process subroutine
>>      break;
>> */
>>
>> /*======================================================*/
>>
>> /*     case "whatever"
>>          Next process subroutine
>>      break;
>> */
>>
>> /*======================================================*/
>>
>> /*     case "whatever"
>>          Next process subroutine
>>      break;
>> */
>>
>> /*======================================================*/
>>
>> /*     case "whatever"
>>          Next process subroutine
>>      break;
>> */
>>
>> /*======================================================*/
>>
>> /*     case "whatever"
>>          Next process subroutine
>>      break;
>> */
>>
>> /*======================================================*/
>>
>> /*     case "whatever"
>>          Next process subroutine
>>      break;
>> */
>>
>> /*======================================================*/
>>
>> /*     case "whatever"
>>          Next process subroutine
>>      break;
>> */
>>
>> /*======================================================*/
>>
>> /*     case "whatever"
>>          Next process subroutine
>>      break;
>> */
>>
>>
>> }
>>
>>
>> ?>
>
> I'll pass on some highly-useful advice I got when I was learning
> to program, back during the last ice age:  make your code look
> neat and clean.  There's no logical reason for that to make bugs
> go away, but in fact it does.
>
> Your program should have a structure something like this:
>
> <?php
>
> 	if ( ! connected( 'taxicabs', 'sometable' ) ) die() ;
>
> 	if ( valid( $_REQUEST ) )
> 	{
> 		$s = 'INSERT INTO taxicabs.sometable SET ' ;
> 		$s .= 'Make="'.$_REQUEST['Make'].'", ' ;
> 		$s .= 'Model="'.$_REQUEST['Model'].'", ' ;
> 		// the other fields the same way
>
> // note that it's just "Make", "Model", etc not
> // "cab_vehicle_make" etc.  because  if you don't already know
> // that you're talking about taxis, not railway locomotives or
> // steamboats, you're in more
> // trouble than wordy fieldnames can ever fix
>
> 		if ( ! mysql_query( $s, $dblink ) )
> 			die( 'Could not create the new record '.
> 				' because '.mysql_error() ) ;
> 	}
> 	else die( 'That is not a valid request because '.
> 	$val_errors ) ;
>
> 	// it needn't be "die()" when something goes wrong,
> 	// it could be some recovery
> 	// routine where you explain what the person should
> 	// do differently and give them another go.  Of course, if
> 	// it's that the server choked or got lost, then die() is '
> 	// perfectly appropriate.
>
>
> // ----------------------------
> function connected( $db, $table )
> {
> 	global $dblink ;
> 	// the mysql connection stuff, returning true if it works, or
> // complain about the problems and return false.
> }
> // ----------------------------
> function valid( $a )
> {
> 	global $val_errors = '' ;
> 	// your validation code.  If it passes your tests,
> 	// return true.  If not, concatenate the complaints into
> 	// $val_errors and return false ;
> }
>
> ?>

Besides all the excellent advice already given to you, didn't you say 
that the choice came from the value of a hidden variable?  If so, then 
you want to switch on the value of the %_POST['name_of_that_variable'].

-- 
Shelly

[toc] | [prev] | [next] | [standalone]

#2823

On 8/15/2011 9:02 PM, sheldonlg wrote:
> On 8/15/2011 2:11 PM, A.Reader wrote:
>> On Mon, 15 Aug 2011 05:35:37 -0700 (PDT),
>> Charles<cchamb2@gmail.com> wrote:
>>
>>> I'm trying to add a record to a database, and it's not working
>>> properly.
>>>
>>> The general thought is to call a data entry form, fill in the form,
>>> and use the $_POST(array) process to pass the data from the form to a
>>> php script that handles adding the record to the database.
>>>
>>> The only trick part of the php script is using a hidden field to pass
>>> the name of the data entry form to a SWITCH statement. I'm trying to
>>> keep the site directory uncluttered and the scripting organized, and I
>>> understand this works.
>>>
>>> I'm getting Error 500 as I test the script, so I think I have
>>> something coded incorrectly in the script, or I have something
>>> missing. Other php-based web applications wrok fine, so I suspect I
>>> have php correctly installed.
>>>
>>> Here's the coding:
>>>
>>> =====================
>>>
>>> <?php
>>>
>>> /*<!-- This starts the switch statement. The variable passed to
>>> control iteration
>>> is the $_Push(switch) variable set in the first (hidden) field in a
>>> data entry form.
>>> The value contained in the variable is the case predicate
>>>
>>> */
>>>
>>>
>>> switch ($_Push(switch)) {
>>>
>>> /*======================================================*/
>>>
>>> case "cab_vehicle_data_entry_add_a_vehicle":
>>>
>>>
>>>
>>> $con = mysql_connect("*********","****","******");<<These are fine
>>> if (!$con)
>>> {
>>> die('Could not connect: ' . mysql_error());
>>> }
>>>
>>> mysql_select_db("taxicab", $con);
>>>
>>> $sql="INSERT INTO
>>> cab_vehicle (cab_vehicle_make, cab_vehicle_model,
>>> cab_vehicle_edition,
>>> cab_vehicle_month, cab_vehicle_year, cab_vehicle_VIN,
>>> cab_vehicle_registration_number,
>>> cab_vehicle_reg_exp_month, cab_vehicle_reg_exp_year,
>>> cab_vehicle_pax_capacity,
>>> cab_vehicle_cubic_feet_cargo, cab_vehicle_cargo_weight)
>>>
>>> VALUES
>>>
>>>
>>> ('$_POST[Make]','$_POST[Model]','$_POST[Edition]','$_POST[Month]','$_POST[year]',
>>>
>>> '$_POST[VIN]','$_POST[Registration]','$_POST[reg_exp_month]','$_POST[reg_exp_year]',
>>>
>>> '$_POST[pax_capacity]','$_POST[cargo_cubic_feet]','$_POST[cargo_weight_lbs]')";
>>>
>>>
>>> if (!mysql_query($sql,$con))
>>> {
>>> die('Error: ' . mysql_error());
>>> }
>>> echo "1 record added";
>>>
>>> mysql_close($con)
>>>
>>> break;
>>>
>>> /*======================================================*/
>>>
>>> /* case "whatever"
>>> Next process subroutine
>>> break;
>>> */
>>>
>>> /*======================================================*/
>>>
>>> /* case "whatever"
>>> Next process subroutine
>>> break;
>>> */
>>>
>>> /*======================================================*/
>>>
>>> /* case "whatever"
>>> Next process subroutine
>>> break;
>>> */
>>>
>>> /*======================================================*/
>>>
>>> /* case "whatever"
>>> Next process subroutine
>>> break;
>>> */
>>>
>>> /*======================================================*/
>>>
>>> /* case "whatever"
>>> Next process subroutine
>>> break;
>>> */
>>>
>>> /*======================================================*/
>>>
>>> /* case "whatever"
>>> Next process subroutine
>>> break;
>>> */
>>>
>>> /*======================================================*/
>>>
>>> /* case "whatever"
>>> Next process subroutine
>>> break;
>>> */
>>>
>>> /*======================================================*/
>>>
>>> /* case "whatever"
>>> Next process subroutine
>>> break;
>>> */
>>>
>>>
>>> }
>>>
>>>
>>> ?>
>>
>> I'll pass on some highly-useful advice I got when I was learning
>> to program, back during the last ice age: make your code look
>> neat and clean. There's no logical reason for that to make bugs
>> go away, but in fact it does.
>>
>> Your program should have a structure something like this:
>>
>> <?php
>>
>> if ( ! connected( 'taxicabs', 'sometable' ) ) die() ;
>>
>> if ( valid( $_REQUEST ) )
>> {
>> $s = 'INSERT INTO taxicabs.sometable SET ' ;
>> $s .= 'Make="'.$_REQUEST['Make'].'", ' ;
>> $s .= 'Model="'.$_REQUEST['Model'].'", ' ;
>> // the other fields the same way
>>
>> // note that it's just "Make", "Model", etc not
>> // "cab_vehicle_make" etc. because if you don't already know
>> // that you're talking about taxis, not railway locomotives or
>> // steamboats, you're in more
>> // trouble than wordy fieldnames can ever fix
>>
>> if ( ! mysql_query( $s, $dblink ) )
>> die( 'Could not create the new record '.
>> ' because '.mysql_error() ) ;
>> }
>> else die( 'That is not a valid request because '.
>> $val_errors ) ;
>>
>> // it needn't be "die()" when something goes wrong,
>> // it could be some recovery
>> // routine where you explain what the person should
>> // do differently and give them another go. Of course, if
>> // it's that the server choked or got lost, then die() is '
>> // perfectly appropriate.
>>
>>
>> // ----------------------------
>> function connected( $db, $table )
>> {
>> global $dblink ;
>> // the mysql connection stuff, returning true if it works, or
>> // complain about the problems and return false.
>> }
>> // ----------------------------
>> function valid( $a )
>> {
>> global $val_errors = '' ;
>> // your validation code. If it passes your tests,
>> // return true. If not, concatenate the complaints into
>> // $val_errors and return false ;
>> }
>>
>> ?>
>
> Besides all the excellent advice already given to you, didn't you say
> that the choice came from the value of a hidden variable? If so, then
> you want to switch on the value of the %_POST['name_of_that_variable'].
>

Which is about as insecure as you can get.  I hope this isn't how you're 
coding for your "Fortune 500" company.  If so, I pity them.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#2825

Is this better?

I still get one error message - Error: You have an error in your SQL
syntax; check the manual that corresponds to your MySQL server version
for the right syntax to use near 'Ford'', ''Crown Victoria'',
''Taxicab'', ''SEP'', '2010', ''sadfasdfsadfdsf' at line 21

=====================================

<?php

/***Switch statement that controls processing from
value of $_POST(deform)***************/

switch ( $_POST['deform'] )

{

/***Case statement that acts on value of $_POST(deform)******/

CASE $_POST['deform'] = "cab_vehicle_data_entry_add_a_vehicle":

$con = mysql_connect("localhost","root","edward");

if (!$con)

{

die("Could not connect: " . mysql_error());

}

function check_input($value)
 {

 if (get_magic_quotes_gpc())
   {
   $value = stripslashes($value);
   }

 if (!is_numeric($value))
   {
   $value = "'" . mysql_real_escape_string($value) . "'";
   }
 return $value;
 }

$Make = check_input($_POST['Make']);
$Model = check_input($_POST['Model']);
$Edition = check_input($_POST['Edition']);
$Month = check_input($_POST['Month']);
$Year = check_input($_POST['Year']);
$VIN = check_input($_POST['VIN']);
$Registration = check_input($_POST['Registration']);
$reg_exp_month = check_input($_POST['reg_exp_month']);
$reg_exp_year = check_input($_POST['reg_exp_year']);
$pax_capacity = check_input($_POST['pax_capacity']);
$cargo_cubic_feet = check_input($_POST['cargo_cubic_feet']);
$cargo_weight_lbs = check_input($_POST['cargo_weight_lbs']);

mysql_select_db("taxicab", $con);

$sql="INSERT INTO

cab_vehicle (
cab_vehicle_make,
cab_vehicle_model,
cab_vehicle_edition,
cab_vehicle_month,
cab_vehicle_year,

cab_vehicle_VIN,
cab_vehicle_registration_number,
cab_vehicle_reg_exp_month,
cab_vehicle_reg_exp_year,

cab_vehicle_pax_capacity,
cab_vehicle_cubic_feet_cargo,
cab_vehicle_cargo_weight)

VALUES

('$Make',
'$Model',
'$Edition',
'$Month',
'$Year',
'$VIN',
'$Registration',
'$reg_exp_month',
'$reg_exp_year',
'$pax_capacity',
'$cargo_cubic_feet',
'$cargo_weight_lbs')";

if (!mysql_query($sql,$con))

{

die("Error: " . mysql_error());

}

echo "1 record added";

mysql_close($con);

break;

}

/******End of CASE statement start of next one*************/

?>

[toc] | [prev] | [next] | [standalone]

#2827

On Tue, 16 Aug 2011 01:30:02 -0700 (PDT),
Charles <cchamb2@gmail.com> wrote:

>Is this better?
>
>I still get one error message - Error: You have an error in your SQL
>syntax; check the manual that corresponds to your MySQL server version
>for the right syntax to use near 'Ford'', ''Crown Victoria'',
>''Taxicab'', ''SEP'', '2010', ''sadfasdfsadfdsf' at line 21
>
>=====================================
>
><?php
>
>/***Switch statement that controls processing from
>value of $_POST(deform)***************/
>
>switch ( $_POST['deform'] )
>
>{
>
>/***Case statement that acts on value of $_POST(deform)******/
>
>CASE $_POST['deform'] = "cab_vehicle_data_entry_add_a_vehicle":
>
>$con = mysql_connect("localhost","root","edward");
>
>if (!$con)
>
>{
>
>die("Could not connect: " . mysql_error());
>
>}
>
>function check_input($value)
> {
>
> if (get_magic_quotes_gpc())
>   {
>   $value = stripslashes($value);
>   }
>
> if (!is_numeric($value))
>   {
>   $value = "'" . mysql_real_escape_string($value) . "'";
>   }
> return $value;
> }
>
>$Make = check_input($_POST['Make']);
>$Model = check_input($_POST['Model']);
>$Edition = check_input($_POST['Edition']);
>$Month = check_input($_POST['Month']);
>$Year = check_input($_POST['Year']);
>$VIN = check_input($_POST['VIN']);
>$Registration = check_input($_POST['Registration']);
>$reg_exp_month = check_input($_POST['reg_exp_month']);
>$reg_exp_year = check_input($_POST['reg_exp_year']);
>$pax_capacity = check_input($_POST['pax_capacity']);
>$cargo_cubic_feet = check_input($_POST['cargo_cubic_feet']);
>$cargo_weight_lbs = check_input($_POST['cargo_weight_lbs']);
>
>mysql_select_db("taxicab", $con);
>
>$sql="INSERT INTO
>
>cab_vehicle (
>cab_vehicle_make,
>cab_vehicle_model,
>cab_vehicle_edition,
>cab_vehicle_month,
>cab_vehicle_year,
>
>cab_vehicle_VIN,
>cab_vehicle_registration_number,
>cab_vehicle_reg_exp_month,
>cab_vehicle_reg_exp_year,
>
>cab_vehicle_pax_capacity,
>cab_vehicle_cubic_feet_cargo,
>cab_vehicle_cargo_weight)
>
>VALUES
>
>('$Make',
>'$Model',
>'$Edition',
>'$Month',
>'$Year',
>'$VIN',
>'$Registration',
>'$reg_exp_month',
>'$reg_exp_year',
>'$pax_capacity',
>'$cargo_cubic_feet',
>'$cargo_weight_lbs')";
>
>if (!mysql_query($sql,$con))
>
>{
>
>die("Error: " . mysql_error());
>
>}
>
>echo "1 record added";
>
>mysql_close($con);
>
>break;
>
>}
>
>/******End of CASE statement start of next one*************/
>
>?>

Don't use the INSERT var1,var2,var3,var4,var5 VALUES
val1,val2,val3,val5 style -- it's prone to misalignment errors
when you're doing more than one or two values.   As a matter of
good practice, always use the SET var1=val1, var2=val2, var3=val3
form instead.  That way there's no mistake about which value is
getting assigned to which var (did you notice the 'error'?)

Further, do all your testing for the record in one lump, not on a
per-field basis.  The reason being that unless your validation
routine can see everything at once, the person could enter
something like 'Make="Chevrolet", Model="Crown Vic"' and you
wouldn't be able to catch it.

To find mysql errors such as the one you're getting, change your 

die("Error: " . mysql_error()); 

to

die('Error:<br>'.$sql.'<br>'.mysql_error() ) ;

That way, when you get a mysql error, you're looking at both the
text of the error message and the broken mysql statement, which
you can then examine to see where  the problem is.

[toc] | [prev] | [next] | [standalone]

#2830

On 8/16/2011 5:41 AM, A.Reader wrote:
> On Tue, 16 Aug 2011 01:30:02 -0700 (PDT),
> Charles<cchamb2@gmail.com>  wrote:
>
>> Is this better?
>>
>> I still get one error message - Error: You have an error in your SQL
>> syntax; check the manual that corresponds to your MySQL server version
>> for the right syntax to use near 'Ford'', ''Crown Victoria'',
>> ''Taxicab'', ''SEP'', '2010', ''sadfasdfsadfdsf' at line 21
>>
>> =====================================
>>
>> <?php
>>
>> /***Switch statement that controls processing from
>> value of $_POST(deform)***************/
>>
>> switch ( $_POST['deform'] )
>>
>> {
>>
>> /***Case statement that acts on value of $_POST(deform)******/
>>
>> CASE $_POST['deform'] = "cab_vehicle_data_entry_add_a_vehicle":
>>
>> $con = mysql_connect("localhost","root","edward");
>>
>> if (!$con)
>>
>> {
>>
>> die("Could not connect: " . mysql_error());
>>
>> }
>>
>> function check_input($value)
>> {
>>
>> if (get_magic_quotes_gpc())
>>    {
>>    $value = stripslashes($value);
>>    }
>>
>> if (!is_numeric($value))
>>    {
>>    $value = "'" . mysql_real_escape_string($value) . "'";
>>    }
>> return $value;
>> }
>>
>> $Make = check_input($_POST['Make']);
>> $Model = check_input($_POST['Model']);
>> $Edition = check_input($_POST['Edition']);
>> $Month = check_input($_POST['Month']);
>> $Year = check_input($_POST['Year']);
>> $VIN = check_input($_POST['VIN']);
>> $Registration = check_input($_POST['Registration']);
>> $reg_exp_month = check_input($_POST['reg_exp_month']);
>> $reg_exp_year = check_input($_POST['reg_exp_year']);
>> $pax_capacity = check_input($_POST['pax_capacity']);
>> $cargo_cubic_feet = check_input($_POST['cargo_cubic_feet']);
>> $cargo_weight_lbs = check_input($_POST['cargo_weight_lbs']);
>>
>> mysql_select_db("taxicab", $con);
>>
>> $sql="INSERT INTO
>>
>> cab_vehicle (
>> cab_vehicle_make,
>> cab_vehicle_model,
>> cab_vehicle_edition,
>> cab_vehicle_month,
>> cab_vehicle_year,
>>
>> cab_vehicle_VIN,
>> cab_vehicle_registration_number,
>> cab_vehicle_reg_exp_month,
>> cab_vehicle_reg_exp_year,
>>
>> cab_vehicle_pax_capacity,
>> cab_vehicle_cubic_feet_cargo,
>> cab_vehicle_cargo_weight)
>>
>> VALUES
>>
>> ('$Make',
>> '$Model',
>> '$Edition',
>> '$Month',
>> '$Year',
>> '$VIN',
>> '$Registration',
>> '$reg_exp_month',
>> '$reg_exp_year',
>> '$pax_capacity',
>> '$cargo_cubic_feet',
>> '$cargo_weight_lbs')";
>>
>> if (!mysql_query($sql,$con))
>>
>> {
>>
>> die("Error: " . mysql_error());
>>
>> }
>>
>> echo "1 record added";
>>
>> mysql_close($con);
>>
>> break;
>>
>> }
>>
>> /******End of CASE statement start of next one*************/
>>
>> ?>
>
> Don't use the INSERT var1,var2,var3,var4,var5 VALUES
> val1,val2,val3,val5 style -- it's prone to misalignment errors
> when you're doing more than one or two values.   As a matter of
> good practice, always use the SET var1=val1, var2=val2, var3=val3
> form instead.  That way there's no mistake about which value is
> getting assigned to which var (did you notice the 'error'?)
>

Terrible advice.  He is doing it the correct way, according to the SQL 
standard.  SET in an INSERT statement is non-standard and AFAIK only 
supported by MySQL (and then only when not running in STRICT mode).

> Further, do all your testing for the record in one lump, not on a
> per-field basis.  The reason being that unless your validation
> routine can see everything at once, the person could enter
> something like 'Make="Chevrolet", Model="Crown Vic"' and you
> wouldn't be able to catch it.
>

There is nothing wrong with such a search.  It will just not return any 
rows.  Trying to validate all possible combinations like this will add 
unnecessary complexity to the code.

The purpose of validation at this level is not to ensure that 
combinations are valid - but that the field itself is the correct type 
and possibly a reasonable value.

> To find mysql errors such as the one you're getting, change your
>
> die("Error: " . mysql_error());
>
> to
>
> die('Error:<br>'.$sql.'<br>'.mysql_error() ) ;
>
> That way, when you get a mysql error, you're looking at both the
> text of the error message and the broken mysql statement, which
> you can then examine to see where  the problem is.

Better yet - get rid of the die() all together and handle the error 
gracefully.  Then ask about the SQL problem in the appropriate newsgroup.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#2831

On Tue, 16 Aug 2011 06:23:06 -0400,
Jerry Stuckle <jstucklex@attglobal.net> wrote:

>On 8/16/2011 5:41 AM, A.Reader wrote:
>> On Tue, 16 Aug 2011 01:30:02 -0700 (PDT),
>> Charles<cchamb2@gmail.com>  wrote:
>>
>>> Is this better?
>>>
>>> I still get one error message - Error: You have an error in your SQL
>>> syntax; check the manual that corresponds to your MySQL server version
>>> for the right syntax to use near 'Ford'', ''Crown Victoria'',
>>> ''Taxicab'', ''SEP'', '2010', ''sadfasdfsadfdsf' at line 21
>>>
>>> =====================================
>>>
>>> <?php
>>>
>>> /***Switch statement that controls processing from
>>> value of $_POST(deform)***************/
>>>
>>> switch ( $_POST['deform'] )
>>>
>>> {
>>>
>>> /***Case statement that acts on value of $_POST(deform)******/
>>>
>>> CASE $_POST['deform'] = "cab_vehicle_data_entry_add_a_vehicle":
>>>
>>> $con = mysql_connect("localhost","root","edward");
>>>
>>> if (!$con)
>>>
>>> {
>>>
>>> die("Could not connect: " . mysql_error());
>>>
>>> }
>>>
>>> function check_input($value)
>>> {
>>>
>>> if (get_magic_quotes_gpc())
>>>    {
>>>    $value = stripslashes($value);
>>>    }
>>>
>>> if (!is_numeric($value))
>>>    {
>>>    $value = "'" . mysql_real_escape_string($value) . "'";
>>>    }
>>> return $value;
>>> }
>>>
>>> $Make = check_input($_POST['Make']);
>>> $Model = check_input($_POST['Model']);
>>> $Edition = check_input($_POST['Edition']);
>>> $Month = check_input($_POST['Month']);
>>> $Year = check_input($_POST['Year']);
>>> $VIN = check_input($_POST['VIN']);
>>> $Registration = check_input($_POST['Registration']);
>>> $reg_exp_month = check_input($_POST['reg_exp_month']);
>>> $reg_exp_year = check_input($_POST['reg_exp_year']);
>>> $pax_capacity = check_input($_POST['pax_capacity']);
>>> $cargo_cubic_feet = check_input($_POST['cargo_cubic_feet']);
>>> $cargo_weight_lbs = check_input($_POST['cargo_weight_lbs']);
>>>
>>> mysql_select_db("taxicab", $con);
>>>
>>> $sql="INSERT INTO
>>>
>>> cab_vehicle (
>>> cab_vehicle_make,
>>> cab_vehicle_model,
>>> cab_vehicle_edition,
>>> cab_vehicle_month,
>>> cab_vehicle_year,
>>>
>>> cab_vehicle_VIN,
>>> cab_vehicle_registration_number,
>>> cab_vehicle_reg_exp_month,
>>> cab_vehicle_reg_exp_year,
>>>
>>> cab_vehicle_pax_capacity,
>>> cab_vehicle_cubic_feet_cargo,
>>> cab_vehicle_cargo_weight)
>>>
>>> VALUES
>>>
>>> ('$Make',
>>> '$Model',
>>> '$Edition',
>>> '$Month',
>>> '$Year',
>>> '$VIN',
>>> '$Registration',
>>> '$reg_exp_month',
>>> '$reg_exp_year',
>>> '$pax_capacity',
>>> '$cargo_cubic_feet',
>>> '$cargo_weight_lbs')";
>>>
>>> if (!mysql_query($sql,$con))
>>>
>>> {
>>>
>>> die("Error: " . mysql_error());
>>>
>>> }
>>>
>>> echo "1 record added";
>>>
>>> mysql_close($con);
>>>
>>> break;
>>>
>>> }
>>>
>>> /******End of CASE statement start of next one*************/
>>>
>>> ?>
>>
>> Don't use the INSERT var1,var2,var3,var4,var5 VALUES
>> val1,val2,val3,val5 style -- it's prone to misalignment errors
>> when you're doing more than one or two values.   As a matter of
>> good practice, always use the SET var1=val1, var2=val2, var3=val3
>> form instead.  That way there's no mistake about which value is
>> getting assigned to which var (did you notice the 'error'?)
>>
>
>Terrible advice.  He is doing it the correct way, according to the SQL 
>standard.  SET in an INSERT statement is non-standard and AFAIK only 
>supported by MySQL (and then only when not running in STRICT mode).

Why would he need -or want- to eliminate MySQL-specific
extensions, unless he's planning to port the code?  What would
the practical payoff be?

>
>> Further, do all your testing for the record in one lump, not on a
>> per-field basis.  The reason being that unless your validation
>> routine can see everything at once, the person could enter
>> something like 'Make="Chevrolet", Model="Crown Vic"' and you
>> wouldn't be able to catch it.
>>
>
>There is nothing wrong with such a search.  It will just not return any 
>rows.  Trying to validate all possible combinations like this will add 
>unnecessary complexity to the code.
>
>The purpose of validation at this level is not to ensure that 
>combinations are valid - but that the field itself is the correct type 
>and possibly a reasonable value.

Aren't we talking about validation at INSERT time, not SELECT
time?  I thought we were, but I might be confused.  

>
>> To find mysql errors such as the one you're getting, change your
>>
>> die("Error: " . mysql_error());
>>
>> to
>>
>> die('Error:<br>'.$sql.'<br>'.mysql_error() ) ;
>>
>> That way, when you get a mysql error, you're looking at both the
>> text of the error message and the broken mysql statement, which
>> you can then examine to see where  the problem is.
>
>Better yet - get rid of the die() all together and handle the error 
>gracefully. Then ask about the SQL problem in the appropriate newsgroup.

We're talking about the debugging phase here, aren't we?  There
shouldn't _be_ any sql errors left by rollout.

And, from the error msg, the error doesn't represent an "SQL
problem" as such but rather a plain syntax error.  My suggestion
was aimed at helping him improve his PHP code such that he could
then find the error.  That seems to be within the remit of this
group.

[toc] | [prev] | [next] | [standalone]

#2832

In article <ttnk47593ucb0h3crdh61kemnbuc88q5mr@4ax.com>,
 A.Reader <anonymously@example.com> wrote:

> On Tue, 16 Aug 2011 06:23:06 -0400,
> Jerry Stuckle <jstucklex@attglobal.net> wrote:

> >Better yet - get rid of the die() all together and handle the error 
> >gracefully. Then ask about the SQL problem in the appropriate newsgroup.
> 
> We're talking about the debugging phase here, aren't we?  There
> shouldn't _be_ any sql errors left by rollout.
> 
> And, from the error msg, the error doesn't represent an "SQL
> problem" as such but rather a plain syntax error.  My suggestion
> was aimed at helping him improve his PHP code such that he could
> then find the error.  That seems to be within the remit of this
> group.

You're overlooking bugs in the implementations that you rely on, and 
obscure bugs of your own. I get occasional SQLite errors that I believe 
to be SQLite bugs, but I'm not 100% sure if that's true. I have my own 
wrapper on SQLite calls that uses try/catch, and logs errors to a 
logfile, with as much info as possible. This sort of approach should be 
designed in as soon as possible in the app.

Just imagining that "there won't be any mysql (or whatever) errors by 
rollout" is naive.

-- 
Tim

"That excessive bail ought not to be required, nor excessive fines imposed,
nor cruel and unusual punishments inflicted"  --  Bill of Rights 1689

[toc] | [prev] | [next] | [standalone]

#2833

On Tue, 16 Aug 2011 14:51:27 +0100,
Tim Streater <timstreater@greenbee.net> wrote:

>In article <ttnk47593ucb0h3crdh61kemnbuc88q5mr@4ax.com>,
> A.Reader <anonymously@example.com> wrote:
>
>> On Tue, 16 Aug 2011 06:23:06 -0400,
>> Jerry Stuckle <jstucklex@attglobal.net> wrote:
>
>> >Better yet - get rid of the die() all together and handle the error 
>> >gracefully. Then ask about the SQL problem in the appropriate newsgroup.
>> 
>> We're talking about the debugging phase here, aren't we?  There
>> shouldn't _be_ any sql errors left by rollout.
>> 
>> And, from the error msg, the error doesn't represent an "SQL
>> problem" as such but rather a plain syntax error.  My suggestion
>> was aimed at helping him improve his PHP code such that he could
>> then find the error.  That seems to be within the remit of this
>> group.
>
>You're overlooking bugs in the implementations that you rely on, and 
>obscure bugs of your own. I get occasional SQLite errors that I believe 
>to be SQLite bugs, but I'm not 100% sure if that's true. I have my own 
>wrapper on SQLite calls that uses try/catch, and logs errors to a 
>logfile, with as much info as possible. This sort of approach should be 
>designed in as soon as possible in the app.
>
>Just imagining that "there won't be any mysql (or whatever) errors by 
>rollout" is naive.

We might be talking about two different things.  

Nearly everything I've ever written has been console-bound, or
has been some utility that's going to be run as a batch job maybe
10 times at the most.

So I write in a very simple-minded, plodding way, and that seems
to protect me from those glitchy-type bugs that cause the mental
problems and premature aging.   The bugs that show up, show up
early and tend to be pretty clearly Mine or Theirs.

But I agree with you (and Jerry) that production code should be
prepared to handle residual errors, and preferably in a classier
way than by just clutching its throat and going spark out. 

I'd argue, though, that our friend Charles, here, is well before
needing to think about production issues.  He's still trying to
get basic db-app code to do something besides halt and fall over.
For that stage of things, I find die() to be a usefully quick way
to deliver debug info.

[toc] | [prev] | [next] | [standalone]

#2838

In article <rqtk47h8v3elpft288le3nfkqt1cjuu572@4ax.com>,
 A.Reader <anonymously@example.com> wrote:

> On Tue, 16 Aug 2011 14:51:27 +0100,
> Tim Streater <timstreater@greenbee.net> wrote:
> 
> >In article <ttnk47593ucb0h3crdh61kemnbuc88q5mr@4ax.com>,
> > A.Reader <anonymously@example.com> wrote:
> >
> >> On Tue, 16 Aug 2011 06:23:06 -0400,
> >> Jerry Stuckle <jstucklex@attglobal.net> wrote:
> >
> >> >Better yet - get rid of the die() all together and handle the error 
> >> >gracefully. Then ask about the SQL problem in the appropriate newsgroup.
> >> 
> >> We're talking about the debugging phase here, aren't we?  There
> >> shouldn't _be_ any sql errors left by rollout.
> >> 
> >> And, from the error msg, the error doesn't represent an "SQL
> >> problem" as such but rather a plain syntax error.  My suggestion
> >> was aimed at helping him improve his PHP code such that he could
> >> then find the error.  That seems to be within the remit of this
> >> group.
> >
> >You're overlooking bugs in the implementations that you rely on, and 
> >obscure bugs of your own. I get occasional SQLite errors that I believe 
> >to be SQLite bugs, but I'm not 100% sure if that's true. I have my own 
> >wrapper on SQLite calls that uses try/catch, and logs errors to a 
> >logfile, with as much info as possible. This sort of approach should be 
> >designed in as soon as possible in the app.
> >
> >Just imagining that "there won't be any mysql (or whatever) errors by 
> >rollout" is naive.
> 
> We might be talking about two different things.

Quite possibly. 

> Nearly everything I've ever written has been console-bound, or
> has been some utility that's going to be run as a batch job maybe
> 10 times at the most.
> 
> So I write in a very simple-minded, plodding way, and that seems
> to protect me from those glitchy-type bugs that cause the mental
> problems and premature aging.   The bugs that show up, show up
> early and tend to be pretty clearly Mine or Theirs.
>
> But I agree with you (and Jerry) that production code should be
> prepared to handle residual errors, and preferably in a classier
> way than by just clutching its throat and going spark out. 
> 
> I'd argue, though, that our friend Charles, here, is well before
> needing to think about production issues.  He's still trying to
> get basic db-app code to do something besides halt and fall over.
> For that stage of things, I find die() to be a usefully quick way
> to deliver debug info.

He (and a lot of other folk who show up here with trivial problems) need 
to learn to do a bit of basic debugging and use the echo statement a bit 
to find out what's going on.

-- 
Tim

"That excessive bail ought not to be required, nor excessive fines imposed,
nor cruel and unusual punishments inflicted"  --  Bill of Rights 1689

[toc] | [prev] | [next] | [standalone]

#2853

On 8/16/2011 9:11 AM, A.Reader wrote:
> On Tue, 16 Aug 2011 06:23:06 -0400,
> Jerry Stuckle<jstucklex@attglobal.net>  wrote:
>
>> On 8/16/2011 5:41 AM, A.Reader wrote:
>>> On Tue, 16 Aug 2011 01:30:02 -0700 (PDT),
>>> Charles<cchamb2@gmail.com>   wrote:
>>>
>>>> Is this better?
>>>>
>>>> I still get one error message - Error: You have an error in your SQL
>>>> syntax; check the manual that corresponds to your MySQL server version
>>>> for the right syntax to use near 'Ford'', ''Crown Victoria'',
>>>> ''Taxicab'', ''SEP'', '2010', ''sadfasdfsadfdsf' at line 21
>>>>
>>>> =====================================
>>>>
>>>> <?php
>>>>
>>>> /***Switch statement that controls processing from
>>>> value of $_POST(deform)***************/
>>>>
>>>> switch ( $_POST['deform'] )
>>>>
>>>> {
>>>>
>>>> /***Case statement that acts on value of $_POST(deform)******/
>>>>
>>>> CASE $_POST['deform'] = "cab_vehicle_data_entry_add_a_vehicle":
>>>>
>>>> $con = mysql_connect("localhost","root","edward");
>>>>
>>>> if (!$con)
>>>>
>>>> {
>>>>
>>>> die("Could not connect: " . mysql_error());
>>>>
>>>> }
>>>>
>>>> function check_input($value)
>>>> {
>>>>
>>>> if (get_magic_quotes_gpc())
>>>>     {
>>>>     $value = stripslashes($value);
>>>>     }
>>>>
>>>> if (!is_numeric($value))
>>>>     {
>>>>     $value = "'" . mysql_real_escape_string($value) . "'";
>>>>     }
>>>> return $value;
>>>> }
>>>>
>>>> $Make = check_input($_POST['Make']);
>>>> $Model = check_input($_POST['Model']);
>>>> $Edition = check_input($_POST['Edition']);
>>>> $Month = check_input($_POST['Month']);
>>>> $Year = check_input($_POST['Year']);
>>>> $VIN = check_input($_POST['VIN']);
>>>> $Registration = check_input($_POST['Registration']);
>>>> $reg_exp_month = check_input($_POST['reg_exp_month']);
>>>> $reg_exp_year = check_input($_POST['reg_exp_year']);
>>>> $pax_capacity = check_input($_POST['pax_capacity']);
>>>> $cargo_cubic_feet = check_input($_POST['cargo_cubic_feet']);
>>>> $cargo_weight_lbs = check_input($_POST['cargo_weight_lbs']);
>>>>
>>>> mysql_select_db("taxicab", $con);
>>>>
>>>> $sql="INSERT INTO
>>>>
>>>> cab_vehicle (
>>>> cab_vehicle_make,
>>>> cab_vehicle_model,
>>>> cab_vehicle_edition,
>>>> cab_vehicle_month,
>>>> cab_vehicle_year,
>>>>
>>>> cab_vehicle_VIN,
>>>> cab_vehicle_registration_number,
>>>> cab_vehicle_reg_exp_month,
>>>> cab_vehicle_reg_exp_year,
>>>>
>>>> cab_vehicle_pax_capacity,
>>>> cab_vehicle_cubic_feet_cargo,
>>>> cab_vehicle_cargo_weight)
>>>>
>>>> VALUES
>>>>
>>>> ('$Make',
>>>> '$Model',
>>>> '$Edition',
>>>> '$Month',
>>>> '$Year',
>>>> '$VIN',
>>>> '$Registration',
>>>> '$reg_exp_month',
>>>> '$reg_exp_year',
>>>> '$pax_capacity',
>>>> '$cargo_cubic_feet',
>>>> '$cargo_weight_lbs')";
>>>>
>>>> if (!mysql_query($sql,$con))
>>>>
>>>> {
>>>>
>>>> die("Error: " . mysql_error());
>>>>
>>>> }
>>>>
>>>> echo "1 record added";
>>>>
>>>> mysql_close($con);
>>>>
>>>> break;
>>>>
>>>> }
>>>>
>>>> /******End of CASE statement start of next one*************/
>>>>
>>>> ?>
>>>
>>> Don't use the INSERT var1,var2,var3,var4,var5 VALUES
>>> val1,val2,val3,val5 style -- it's prone to misalignment errors
>>> when you're doing more than one or two values.   As a matter of
>>> good practice, always use the SET var1=val1, var2=val2, var3=val3
>>> form instead.  That way there's no mistake about which value is
>>> getting assigned to which var (did you notice the 'error'?)
>>>
>>
>> Terrible advice.  He is doing it the correct way, according to the SQL
>> standard.  SET in an INSERT statement is non-standard and AFAIK only
>> supported by MySQL (and then only when not running in STRICT mode).
>
> Why would he need -or want- to eliminate MySQL-specific
> extensions, unless he's planning to port the code?  What would
> the practical payoff be?
>

Well, for one thing, if he gets on a MySQL server which enforces STRICT 
SQL standards.

And it's always a good idea to get in the habit of using 
standards-compliant code.  You never know when someone may want you to 
port it to another database - or even if you want to start learning 
another database.

There is no problem with using standards-compliant code here.  It is 
very easy to keep things straight if you format your code properly.

>>
>>> Further, do all your testing for the record in one lump, not on a
>>> per-field basis.  The reason being that unless your validation
>>> routine can see everything at once, the person could enter
>>> something like 'Make="Chevrolet", Model="Crown Vic"' and you
>>> wouldn't be able to catch it.
>>>
>>
>> There is nothing wrong with such a search.  It will just not return any
>> rows.  Trying to validate all possible combinations like this will add
>> unnecessary complexity to the code.
>>
>> The purpose of validation at this level is not to ensure that
>> combinations are valid - but that the field itself is the correct type
>> and possibly a reasonable value.
>
> Aren't we talking about validation at INSERT time, not SELECT
> time?  I thought we were, but I might be confused.
>

Yes, we are.

>>
>>> To find mysql errors such as the one you're getting, change your
>>>
>>> die("Error: " . mysql_error());
>>>
>>> to
>>>
>>> die('Error:<br>'.$sql.'<br>'.mysql_error() ) ;
>>>
>>> That way, when you get a mysql error, you're looking at both the
>>> text of the error message and the broken mysql statement, which
>>> you can then examine to see where  the problem is.
>>
>> Better yet - get rid of the die() all together and handle the error
>> gracefully. Then ask about the SQL problem in the appropriate newsgroup.
>
> We're talking about the debugging phase here, aren't we?  There
> shouldn't _be_ any sql errors left by rollout.
>

And when you have to go back and change the code to get rid of all the 
die() statements, you add another possibility for errors being 
introduced - or even forget to do it.

Better to not do it in the first place.

> And, from the error msg, the error doesn't represent an "SQL
> problem" as such but rather a plain syntax error.  My suggestion
> was aimed at helping him improve his PHP code such that he could
> then find the error.  That seems to be within the remit of this
> group.
>

Please show me where in the PHP manual it documents SQL errors - or even 
the syntax of a SQL statement.

The final solution may be in PHP code - but the ERROR is SQL - and 
should be followed up that way.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#2829

On 8/16/2011 4:30 AM, Charles wrote:
> Is this better?
>
> I still get one error message - Error: You have an error in your SQL
> syntax; check the manual that corresponds to your MySQL server version
> for the right syntax to use near 'Ford'', ''Crown Victoria'',
> ''Taxicab'', ''SEP'', '2010', ''sadfasdfsadfdsf' at line 21
>
> =====================================
>
> <?php
>
> /***Switch statement that controls processing from
> value of $_POST(deform)***************/
>
> switch ( $_POST['deform'] )
>
> {
>
> /***Case statement that acts on value of $_POST(deform)******/
>
> CASE $_POST['deform'] = "cab_vehicle_data_entry_add_a_vehicle":
>
> $con = mysql_connect("localhost","root","edward");
>
> if (!$con)
>
> {
>
> die("Could not connect: " . mysql_error());
>
> }
>
> function check_input($value)
>   {
>
>   if (get_magic_quotes_gpc())
>     {
>     $value = stripslashes($value);
>     }
>
>   if (!is_numeric($value))
>     {
>     $value = "'" . mysql_real_escape_string($value) . "'";
>     }
>   return $value;
>   }
>
> $Make = check_input($_POST['Make']);
> $Model = check_input($_POST['Model']);
> $Edition = check_input($_POST['Edition']);
> $Month = check_input($_POST['Month']);
> $Year = check_input($_POST['Year']);
> $VIN = check_input($_POST['VIN']);
> $Registration = check_input($_POST['Registration']);
> $reg_exp_month = check_input($_POST['reg_exp_month']);
> $reg_exp_year = check_input($_POST['reg_exp_year']);
> $pax_capacity = check_input($_POST['pax_capacity']);
> $cargo_cubic_feet = check_input($_POST['cargo_cubic_feet']);
> $cargo_weight_lbs = check_input($_POST['cargo_weight_lbs']);
>
> mysql_select_db("taxicab", $con);
>
> $sql="INSERT INTO
>
> cab_vehicle (
> cab_vehicle_make,
> cab_vehicle_model,
> cab_vehicle_edition,
> cab_vehicle_month,
> cab_vehicle_year,
>
> cab_vehicle_VIN,
> cab_vehicle_registration_number,
> cab_vehicle_reg_exp_month,
> cab_vehicle_reg_exp_year,
>
> cab_vehicle_pax_capacity,
> cab_vehicle_cubic_feet_cargo,
> cab_vehicle_cargo_weight)
>
> VALUES
>
> ('$Make',
> '$Model',
> '$Edition',
> '$Month',
> '$Year',
> '$VIN',
> '$Registration',
> '$reg_exp_month',
> '$reg_exp_year',
> '$pax_capacity',
> '$cargo_cubic_feet',
> '$cargo_weight_lbs')";
>
> if (!mysql_query($sql,$con))
>
> {
>
> die("Error: " . mysql_error());
>
> }
>
> echo "1 record added";
>
> mysql_close($con);
>
> break;
>
> }
>
> /******End of CASE statement start of next one*************/
>
> ?>
>

You have a MySQL message indicating a MySQL problem, not a PHP problem. 
  Try comp.databases.mysql - where you'll get GOOD advice.



-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#2848

On 8/15/2011 9:50 PM, Jerry Stuckle wrote:
> On 8/15/2011 9:02 PM, sheldonlg wrote:
>> On 8/15/2011 2:11 PM, A.Reader wrote:
>>> On Mon, 15 Aug 2011 05:35:37 -0700 (PDT),
>>> Charles<cchamb2@gmail.com> wrote:
>>>
>>>> I'm trying to add a record to a database, and it's not working
>>>> properly.
>>>>
>>>> The general thought is to call a data entry form, fill in the form,
>>>> and use the $_POST(array) process to pass the data from the form to a
>>>> php script that handles adding the record to the database.
>>>>
>>>> The only trick part of the php script is using a hidden field to pass
>>>> the name of the data entry form to a SWITCH statement. I'm trying to
>>>> keep the site directory uncluttered and the scripting organized, and I
>>>> understand this works.
>>>>
>>>> I'm getting Error 500 as I test the script, so I think I have
>>>> something coded incorrectly in the script, or I have something
>>>> missing. Other php-based web applications wrok fine, so I suspect I
>>>> have php correctly installed.
>>>>
>>>> Here's the coding:
>>>>
>>>> =====================
>>>>
>>>> <?php
>>>>
>>>> /*<!-- This starts the switch statement. The variable passed to
>>>> control iteration
>>>> is the $_Push(switch) variable set in the first (hidden) field in a
>>>> data entry form.
>>>> The value contained in the variable is the case predicate
>>>>
>>>> */
>>>>
>>>>
>>>> switch ($_Push(switch)) {
>>>>
>>>> /*======================================================*/
>>>>
>>>> case "cab_vehicle_data_entry_add_a_vehicle":
>>>>
>>>>
>>>>
>>>> $con = mysql_connect("*********","****","******");<<These are fine
>>>> if (!$con)
>>>> {
>>>> die('Could not connect: ' . mysql_error());
>>>> }
>>>>
>>>> mysql_select_db("taxicab", $con);
>>>>
>>>> $sql="INSERT INTO
>>>> cab_vehicle (cab_vehicle_make, cab_vehicle_model,
>>>> cab_vehicle_edition,
>>>> cab_vehicle_month, cab_vehicle_year, cab_vehicle_VIN,
>>>> cab_vehicle_registration_number,
>>>> cab_vehicle_reg_exp_month, cab_vehicle_reg_exp_year,
>>>> cab_vehicle_pax_capacity,
>>>> cab_vehicle_cubic_feet_cargo, cab_vehicle_cargo_weight)
>>>>
>>>> VALUES
>>>>
>>>>
>>>> ('$_POST[Make]','$_POST[Model]','$_POST[Edition]','$_POST[Month]','$_POST[year]',
>>>>
>>>>
>>>> '$_POST[VIN]','$_POST[Registration]','$_POST[reg_exp_month]','$_POST[reg_exp_year]',
>>>>
>>>>
>>>> '$_POST[pax_capacity]','$_POST[cargo_cubic_feet]','$_POST[cargo_weight_lbs]')";
>>>>
>>>>
>>>>
>>>> if (!mysql_query($sql,$con))
>>>> {
>>>> die('Error: ' . mysql_error());
>>>> }
>>>> echo "1 record added";
>>>>
>>>> mysql_close($con)
>>>>
>>>> break;
>>>>
>>>> /*======================================================*/
>>>>
>>>> /* case "whatever"
>>>> Next process subroutine
>>>> break;
>>>> */
>>>>
>>>> /*======================================================*/
>>>>
>>>> /* case "whatever"
>>>> Next process subroutine
>>>> break;
>>>> */
>>>>
>>>> /*======================================================*/
>>>>
>>>> /* case "whatever"
>>>> Next process subroutine
>>>> break;
>>>> */
>>>>
>>>> /*======================================================*/
>>>>
>>>> /* case "whatever"
>>>> Next process subroutine
>>>> break;
>>>> */
>>>>
>>>> /*======================================================*/
>>>>
>>>> /* case "whatever"
>>>> Next process subroutine
>>>> break;
>>>> */
>>>>
>>>> /*======================================================*/
>>>>
>>>> /* case "whatever"
>>>> Next process subroutine
>>>> break;
>>>> */
>>>>
>>>> /*======================================================*/
>>>>
>>>> /* case "whatever"
>>>> Next process subroutine
>>>> break;
>>>> */
>>>>
>>>> /*======================================================*/
>>>>
>>>> /* case "whatever"
>>>> Next process subroutine
>>>> break;
>>>> */
>>>>
>>>>
>>>> }
>>>>
>>>>
>>>> ?>
>>>
>>> I'll pass on some highly-useful advice I got when I was learning
>>> to program, back during the last ice age: make your code look
>>> neat and clean. There's no logical reason for that to make bugs
>>> go away, but in fact it does.
>>>
>>> Your program should have a structure something like this:
>>>
>>> <?php
>>>
>>> if ( ! connected( 'taxicabs', 'sometable' ) ) die() ;
>>>
>>> if ( valid( $_REQUEST ) )
>>> {
>>> $s = 'INSERT INTO taxicabs.sometable SET ' ;
>>> $s .= 'Make="'.$_REQUEST['Make'].'", ' ;
>>> $s .= 'Model="'.$_REQUEST['Model'].'", ' ;
>>> // the other fields the same way
>>>
>>> // note that it's just "Make", "Model", etc not
>>> // "cab_vehicle_make" etc. because if you don't already know
>>> // that you're talking about taxis, not railway locomotives or
>>> // steamboats, you're in more
>>> // trouble than wordy fieldnames can ever fix
>>>
>>> if ( ! mysql_query( $s, $dblink ) )
>>> die( 'Could not create the new record '.
>>> ' because '.mysql_error() ) ;
>>> }
>>> else die( 'That is not a valid request because '.
>>> $val_errors ) ;
>>>
>>> // it needn't be "die()" when something goes wrong,
>>> // it could be some recovery
>>> // routine where you explain what the person should
>>> // do differently and give them another go. Of course, if
>>> // it's that the server choked or got lost, then die() is '
>>> // perfectly appropriate.
>>>
>>>
>>> // ----------------------------
>>> function connected( $db, $table )
>>> {
>>> global $dblink ;
>>> // the mysql connection stuff, returning true if it works, or
>>> // complain about the problems and return false.
>>> }
>>> // ----------------------------
>>> function valid( $a )
>>> {
>>> global $val_errors = '' ;
>>> // your validation code. If it passes your tests,
>>> // return true. If not, concatenate the complaints into
>>> // $val_errors and return false ;
>>> }
>>>
>>> ?>
>>
>> Besides all the excellent advice already given to you, didn't you say
>> that the choice came from the value of a hidden variable? If so, then
>> you want to switch on the value of the %_POST['name_of_that_variable'].
>>
>
> Which is about as insecure as you can get. I hope this isn't how you're
> coding for your "Fortune 500" company. If so, I pity them.

What part of "Besides all the excellent advice already given to you" 
didn't you understand?  I was only addressing that it is $_POST, not push.

As to the other part, no, I don't.  However, even if I did, it wouldn't 
be much of a big deal as all that coding is for an intranet behind a 
very secure firewall.

-- 
Shelly

[toc] | [prev] | [next] | [standalone]

#2854

On 8/16/2011 4:13 PM, sheldonlg wrote:
> On 8/15/2011 9:50 PM, Jerry Stuckle wrote:
<snip>
>> Which is about as insecure as you can get. I hope this isn't how you're
>> coding for your "Fortune 500" company. If so, I pity them.
>
> What part of "Besides all the excellent advice already given to you"
> didn't you understand? I was only addressing that it is $_POST, not push.
>
> As to the other part, no, I don't. However, even if I did, it wouldn't
> be much of a big deal as all that coding is for an intranet behind a
> very secure firewall.
>

And you NEVER have any problems behind a "very secure firewall"?  Let me 
clue you, Sheldon - the most common hacks still come from internal 
sources - disgruntled employees, etc. - behind your "secure firewall". 
You just don't hear about them because the companies don't broadcast why 
they fired someone (unless it's a very big hack).  And ANY security 
professional will tell you to NEVER depend on just one layer of security 
- always build multiple layers into the system.

Just because it's behind "a very secure firewall" is NOT a reason to 
ignore standard security practices!

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.php

csiph-web