Retrieving $_GET gives error unexpected T_VARIABLE, expecting ',' or ';'

Question

I'm working on an image uploader for a website, the first page lets the user enter the title and description of the image he wants to upload. This is then sent to another page which insert the data into a database and then forwards to a page which lets the user upload the image. I get an error at the database insert part.

when I load addTitleDescDB.php I get the following error

Parse error: syntax error, unexpected T_VARIABLE, expecting ',' or ';' in ../admin/imageupload/addTitleDescDB.php on line 10

The form:

<div id="upload-wrapper">
    <div align="center">
        <h3>Description</h3>
        <form action="addTitleDescDB.php" method="get" id="MyUploadForm">
            <label for="title">Titre:</label>
            <input type="text" name="title" id="title">
            <br><br>
            <label for="desc">Description:</label><br>
            <textarea name="desc" id="desc" cols=40 rows=6></textarea>
            <br><br>
            <input type="submit"  id="submit-btn" value="Envoyer" />
        </form>
    </div>
</div>

addTitleDescDB.php

<?php
  require_once ($_SERVER['DOCUMENT_ROOT'].'/includes/mysql_connect.php'); // Connect to the database.   
  include ($_SERVER['DOCUMENT_ROOT'].'/includes/sanitize.php');

  $_GET = sanitize($_GET); // Sanitize input
  $title = $_GET['title'];
  $desc = $_GET['desc'];

  if(mysql_query("INSERT INTO galerie (title, description) VALUES ($title, $desc)")) {
    $id = mysql_insert_id();
    echo "<script type=\"text/javascript\">window.location.href = '../admin/imageupload/imageupload.php?id=".$id."';</script>";
  }
  else
    echo "<script type=\"text/javascript\">window.location.href = '../admin/imageupload/index.php?error=SQL';</script>";
?>

sanitize.php

<?php
  function cleanInput($input) {
    $search = array(
      '@<script[^>]*?>.*?</script>@si',   // Strip out javascript
      '@<[\/\!]*?[^<>]*?>@si',            // Strip out HTML tags
      '@<style[^>]*?>.*?</style>@siU',    // Strip style tags properly
      '@<![\s\S]*?--[ \t\n\r]*>@'         // Strip multi-line comments
  );

  $output = preg_replace($search, '', $input);
  return $output;
  }
?>

<?php
  function sanitize($input) {
    if (is_array($input)) {
      foreach($input as $var=>$val) {
        $output[$var] = sanitize($val);
      }
    }
    else {
      if (get_magic_quotes_gpc()) {
        $input = stripslashes($input);
      }
      $input  = cleanInput($input);
      $output = mysql_real_escape_string($input);
    }
    return $output;
  }
?>

Wrap this `VALUES ($title, $desc)` in quotes `VALUES ('$title', '$desc')` since you're obviously working with strings. Or `VALUES ('".$title."', '".$desc."')` — Funk Forty Niner, Jul 03 '14 at 04:29
@Fred-ii- It works, thanks a lot, I don't know why I didn't think of that. Sometimes you just need to have a fresh look. — madhyve, Jul 03 '14 at 04:34
[Why shouldn't I use mysql_* functions in PHP?](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php) — Phil, Jul 03 '14 at 04:48

score 1 · Accepted Answer · answered Jul 03 '14 at 04:48

In your addTitleDescDB.php try this:

<?php
  require_once ($_SERVER['DOCUMENT_ROOT'].'/includes/mysql_connect.php'); // Connect to the database.   
  include ($_SERVER['DOCUMENT_ROOT'].'/includes/sanitize.php');

  $_GET = sanitize($_GET); // Sanitize input
  $title = $_GET['title'];
  $desc = $_GET['desc'];

  if(mysql_query("INSERT INTO galerie (title, description) VALUES ('".$title."','".$desc."')")) {
    $id = mysql_insert_id();
    echo "<script type=\"text/javascript\">window.location.href = '../admin/imageupload/imageupload.php?id=".$id."';</script>";
  }
  else
    echo "<script type=\"text/javascript\">window.location.href = '../admin/imageupload/index.php?error=SQL';</script>";
?>

score 0 · Answer 2 · answered Jul 03 '14 at 04:34

your query variable should be quoted and give proper quote to your script

try to change

if(mysql_query("INSERT INTO galerie (title, description) VALUES ('$title', '$desc')")) {
    $id = mysql_insert_id();
    echo "<script type='text/javascript'>window.location.href = '../admin/imageupload/imageupload.php?id=$id';</script>";
  }
  else
    echo "<script type='text/javascript'>window.location.href = '../admin/imageupload/index.php?error=SQL';</script>";

Retrieving $_GET gives error unexpected T_VARIABLE, expecting ',' or ';'

2 Answers2