PHP Code:

$query  = "SELECT * FROM `images` WHERE `imageid`= $imageid";
$result = mysql_query($query) or die(mysql_error());
while ( $row = mysql_fetch_array($result) ) : 
  //Check to see if this is 5th image and if so, close the table row and reset the count to 1 

if ($count==5){ 
 echo('<TD><a href="javascript:popUp('."popupimage.php".')"><img src="$row->imageid/$row->imagename"</a><br>'); 
 echo('</TD></TR><TR>'); 
    $count=1; 
  //If this is not the 5th image, add the image in the table and add 1 to the count 
  }else{ 
 echo('<TD><a href="javascript:popUp('."popupimage.php".')"><img src="$row->imageid/$row->imagename"</a><br>'); 
 echo('</TD>'); 
    $count++; 
  } 
endwhile; 


Can someobdy please tell me what is worng with this.

My error is

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'f1b4de0d' at line 1

f1b4de0d is the value of $imageid


The query works fine withour the where condition and just turns up all the images in the table.

$imageid is a string so needs single quotes around it

cheers chrishirst, you save my *** once again. just isnt my week

sometimes it just takes a different set of eyes

Always use quotes around your $php_variables you put in your MySQL query.

Originally Posted by kaisellgren

Always use quotes around your $php_variables you put in your MySQL query.

Not always

Only when it is a string value.

Originally Posted by chrishirst

Not always

Only when it is a string value.

For beginners (as the topic author is I assume), it is a good practice to always use quotes regardsless of value type. This works fine for integers, etc. too.

I disagree,
Beginners especially should be learning the correct way to set the syntax of queries, NOT using some all encompassing method of avoiding errors.

Slightly off topic but nonetheless relevant is this, from Coding Horror

Originally Posted by chrishirst

I disagree,
Beginners especially should be learning the correct way to set the syntax of queries, NOT using some all encompassing method of avoiding errors.

Slightly off topic but nonetheless relevant is this, from Coding Horror

So if I was a beginner, I would do it this way?

PHP Code:

<?php

$value = $_POST['value'];
if (get_type($value) == 'string')
 $value = "'$value'";
mysql_query("INSERT INTO table (a) VALUES ($value);");

?>

If the data type can be anything, why would I check for if it is a string and then insert quotes around it? Would be much easier to just every time add quotes.

WHERE a = '5';. That finds all rows which field a equals to 5 no matter is the field numeric or string.

EDIT: What errors are you talking about?

But the data type cannot and should not be anything.

It should match whatever the column type is that it is being inserted into. Just adding quotes around anything "just in case" so you avoid the server throwing a syntax error is very poor programming practice.

So if I was a beginner, I would do it this way

No you certainly wouldn't!

You would know what values and what types are to be inserted in to the SQL query and cast or convert the user supplied data into those types.
Failure to check types and values and/or allowing almost anything to be fed into the query opens up your code to SQL injection abuse and all manners of potential data errors.

Originally Posted by chrishirst

But the data type cannot and should not be anything.

It should match whatever the column type is that it is being inserted into. Just adding quotes around anything "just in case" so you avoid the server throwing a syntax error is very poor programming practice.

No you certainly wouldn't!

You would know what values and what types are to be inserted in to the SQL query and cast or convert the user supplied data into those types.
Failure to check types and values and/or allowing almost anything to be fed into the query opens up your code to SQL injection abuse and all manners of potential data errors.

Let me explain this.

I have a field in MySQL:

username VARCHAR(255)

So the username field has some text that contains max 255 characters. The size of the field is always text length bytes + 1 byte.

If I have a form that has field username, and visitor enters 43534534 in the username field it would become:

mysql_query("SELECT a FROM b WHERE username = '43534534';");

That works fine, MySQL will convert your integer to string that will work with our varchar field. Try to debug, zero errors.

PS. I love to argue with you. I always argue

EDIT: If you still don't believe in me. Tell me why phpBB enters data into MySQL without checking data type? Because it does not have to check it, data will be converted to string in all cases. You understand that putting single quotes around $variable will become always a string if we successfully protect against injections. In some cases injections can be harder to protect like in GBK, 0xbf27 is not a valid multi-byte character, but 0xbf5c is. Interpreted as single-byte characters, 0xbf27 is 0xbf (¿) followed by 0x27 ('), and 0xbf5c is 0xbf (¿) followed by 0x5c (\). If I want to attempt an SQL injection attack against a MySQL database, having single quotes escaped with a backslash is a bummer. If you're using addslashes(), however, I'm in luck. All I need to do is inject something like 0xbf27, and addslashes() modifies this to become 0xbf5c27, a valid multi-byte character followed by a single quote. In other words, I can successfully inject a single quote despite your escaping. I a kind of know what you think, but I think you are thinking totally different thing what I am thinking. I actually don't even care what are you trying to claim, I will always follow other scripts made by professional coders like IPS - that way I am 100% sure there is nothing going wrong. And actually nothing has ever gone wrong. My word 'ever' consists of many years.

If I have a MySQL field

userid INT(11) UNSIGNED NOT NULL AUTO_INCREMENT

I know the (11) does nothing but clears the sentence. Anyway, then we need to check that our inserted data is integer.

$userid = (int) $_GET['userid'];
---> ready to insert into DB.

That is what we need to do. But we can always use numbers as strings at database and then use numbers as numbers in PHP, ASP or whatever we are coding with.

CHRISHIRST: Let me test you, tell me is this professional MySQL coding or not:

time INT(10) UNSIGNED NOT NULL DEFAULT '0',

Let's assume we are creating a table with some columns and the above is one of those columns.

username VARCHAR(255)

So the username field has some text that contains max 255 characters. The size of the field is always text length bytes + 1 byte.

If I have a form that has field username, and visitor enters 43534534 in the username field it would become:

mysql_query("SELECT a FROM b WHERE username = '43534534';");

That works fine, MySQL will convert your integer to string that will work with our varchar field. Try to debug, zero errors.

I don't see your point
username = '43534534' is a string and a VARCHAR column type is a string column.
therefore no errors

CHRISHIRST: Let me test you, tell me is this professional MySQL coding or not:

time INT(10) UNSIGNED NOT NULL DEFAULT '0',

It depends on how you define "professional"

Yes it would work and create the column complete with default value, whether it is "good practice" to allow the DB Server to make the choice is debatable.
If and when you are designing code and queries to be cross platform, then you should be explicit with regards to casting and variable/column type.
If you are designing for one platform only and you know that platform and its vagaries well, then you can be less diligent on code interpretation.

Originally Posted by chrishirst

I don't see your point
username = '43534534' is a string and a VARCHAR column type is a string column.
therefore no errors

heh lol?

Originally Posted by kaisellgren

Try to debug, zero errors.

why would you want to debug something that is correct???

You have a number surrounded by quotes which makes it a string value, which is being inserted into a VARCHAR column.

Where's the problem???

In the original post (the one where adding quotes solved the problem) the imageid variable type was ambiguous.
That is;
Because it had characters in it that were not in the range 1 .. 9 it could not be handled by the SQL engine as being numeric, but it did not have quotes around it to explicitly declare it as a string.
So the SQL engine throws an exception.

You just got me wrong, nothing else. Just forget it.