Inserting to database using PDO

Question

Please i try to insert into database but i'm not getting it right. I get this error

Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''mp3')' at line 1' in C:\wamp\www\livingwordmedia\admin\upload-script.php on line 28

Please what i'm i doing wrong.

Here is my code:

    <?php require 'header.php'; require 'upload-script.php'; ?>

<body>
    <div id="wrapper">
    <!-- Navigation -->
    <?php require 'nav.php'; ?>
    <div id="page-wrapper">
      <div class="container-fluid">
      <!-- Page Heading -->
      <div class="row"> 
        <div class="col-lg-12">
          <h1 class="page-header">Upload <small>audio/video/pdf</small></h1>      
        </div>
      </div>

      <div class="row">

        <form action="" method="POST">
        <div class="col-lg-6">
            <div class="form-group">
              <label>Title</label>
              <input type="text" class="form-control" name="title" placeholder="Enter Title">
            </div>

            <div class="form-group">
              <label>Description</label>
              <input type="text" class="form-control" name="description" placeholder="Short Description....">
            </div>
            <div class="form-group">
              <label>Download Link</label>
              <input type="text" class="form-control" name="download_link" placeholder="Download link">
            </div>
          </div>  

          <div class="col-lg-6">
            <div class="form-group">
              <label>Category</label>
              <select name="category" class="form-control">
                <option value="category 1">Category 1</option>
                <option value="category 2">Category 2</option>
                <option value="category 3">Category 3</option>
                <option value="category 4">Category 4</option>
              </select>  
            </div>

            <div class="form-group">
              <label>Format</label>
              <select name="format" class="form-control">
                <option value="mp3">Mp3</option>
                <option value="mp4">Mp4</option>
                <option value="pdf">PDF</option>
              </select>  
            </div>

          <button type="submit" name="submit" class="btn btn-default">Submit</button>
          </div>
        </form>
        </div>
      </div>



      </div>
    </div>

<?php require 'footer.php'; ?>

Here is my upload script:

    <?php

require 'functions.php';

if(isset($_POST['title']) && isset($_POST['description']) && isset($_POST['download_link']) && isset($_POST['category']) && isset($_POST['format'])){
    $title = trim($_POST['title']);
    $description = trim($_POST['description']);
    $download_link = trim($_POST['download_link']);
    $category = ($_POST['category']);
    $format = ($_POST['format']);



    if(!empty($title) && !empty($description) && !empty($download_link) && !empty($category) && !empty($format)){

            $query = $conn->prepare("SELECT title FROM libraries WHERE title = :title");
            $query->bindParam(':title', $title);
            $query->execute();



            if($query->rowCount() > 0){
                echo 'Title already exist';
            }
        else{
        $query = "INSERT INTO libraries (id, title, description, download_link, category, format) VALUES ('','".mysql_real_escape_string($title)."','".mysql_real_escape_string($description)."','".mysql_real_escape_string($download_link)."','".mysql_real_escape_string($category)."', ,'".mysql_real_escape_string($format)."')";

        if($conn->query($query)){
            echo "upload completed";
        }else{
            echo "Upload not completed";
        }
    }
}
}
?>

Pls someone should help.

I'd strongly reccomend looking at prepared statements with the PDO library (http://php.net/manual/en/book.pdo.php) as an alternative to building SQL string this way due to the risk of SQL injection. — bunnmatt, Oct 09 '15 at 10:49
Don't mix mysql_ and PDO! You're doing it completely wrong. Learn how to bind parameters using PDO, not some god awful mix involving mysql_ functions. — deceze, Oct 09 '15 at 10:55

score 0 · Answer 1 · answered Oct 09 '15 at 10:52

0

You have an additional comma between the "category" and "format" fields in the VALUES part of your SQL string.

answered Oct 09 '15 at 10:52

bunnmatt

797
10
23

Inserting to database using PDO

1 Answers1