Sending string containing spaces causes SQL syntax error

Question

I have a select list that contains strings fetched from my database, multiple strings contain spaces and are causing error, at first PHP was not reading the space. I fixed that using quotations but the error is still there.

This is my php code in one file:

$AllDepartements = $db->getAllDepartements();
echo "<select name='Major' style='width: 270px'><option value=''>Select       Major</option>";
While ($row = mysql_fetch_array($AllDepartements))
{
$Major = $row['DName'];
print "<option value='".$Major."'>$Major</option>";

}
print "</select><br>";

and this is the add function call:

else if($tag =='add'){
$SSN =  $_POST['SSN'];
$Class =  $_POST['Class'];
$Major =  $_POST['Major'];
$Minor =  $_POST['Minor'];

if($db->addStudent($SSN,$Class,$Major,$Minor))
header('Location:' . $form . '.php?tag=list');
else
echo mysql_error();
//echo "ERROR!";
}

and finally the function itself:

 public function addStudent($SSN,$Class,$Major,$Minor) {    
    if($result = mysql_query(" INSERT INTO student (SSN,Class,Major,Minor)    VALUES ('$SSN','$Class',$Major,$Minor ")) {
        return true ;
    }
    else 
        return false;
}

The error I receive is:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1

The closing bracket is on the wrong side of the closing `"` for one. Please, echo your queries and do some debugging first. — Nanne, Nov 05 '13 at 11:14
@deceze : how is this a duplicate of that question? I mean, the same problem is in this code, sure, but that's not the question, is it? It is badly researched though. — Nanne, Nov 05 '13 at 11:15

score 0 · Accepted Answer · answered Nov 04 '13 at 14:23

You didn't close VALUES parenthesis:

$result = mysql_query("INSERT INTO student (SSN,Class,Major,Minor) VALUES ('$SSN','$Class',$Major,$Minor)");

And also, you're using a deprecated library of mysql which it is going to be omitted later. Use mysqli or an interface like PDO.

score 0 · Answer 2 · answered Nov 04 '13 at 14:25

0

SYNTAX error in your INSERT query...

"INSERT INTO student (SSN,Class,Major,Minor) VALUES ('$SSN','$Class',$Major,$Minor)"
                                                                                 ^^^^^

answered Nov 04 '13 at 14:25

Sumit Bijvani

8,154
17
50
82

Sending string containing spaces causes SQL syntax error

2 Answers2