Member Avatar for janguyo

Hi guyz ,
PHP newbie and this piece is givin me a hard time please Help, have indicated the source of the error with a comment

    <?php
    ob_start();
     include("dataaccess.php"); ?>
    <?php 

    $strAction = "list";
        $num = "";
        $strTable = "";
        $strkey = "";


        if(!empty($_POST))
        {
        if (trim($strTable) == "" )
        {
            if ($_POST["tablename"] <> "")
                $strTable = $_POST["tablename"];
        }

        if (trim($strkey) == "" )
            $strkey = $_POST["key"];
        }

        dbConnect();
        $result = mysql_query("Select * from " . $strTable . mysql_error());//this is the error source

        if (!$result)
        {
            die('Invalid formation of Select query in editInsertExec: ' . mysql_error());
        }

        $columns = mysql_num_fields($result);

        $sqlQuery = "INSERT INTO " . $strTable . " (";
        for ($i = 0; $i <= mysql_num_fields($result); $i++) 
        {      
                 if ( mysql_field_name($result, $i) <> $strkey)
                 {  
                 $sqlQuery = $sqlQuery . mysql_field_name($result, $i);
                 if ($i < mysql_num_fields($result)-1)
                    $sqlQuery = $sqlQuery . ", ";       
                }   
        }

        $sqlQuery = $sqlQuery . ") VALUES (" ;

        for ($i = 0; $i <= mysql_num_fields($result); $i++) 
        {   
             if ( mysql_field_name($result, $i) <> $strkey)
                 {
                    $sqlQuery = $sqlQuery . "'" .$_POST[mysql_field_name($result, $i)] . "'" ;
                    if ($i < mysql_num_fields($result)-1)
                            $sqlQuery = $sqlQuery . ", ";
                }
        }



        $sqlQuery = $sqlQuery . ")";

        $sqlQuery = str_replace("''", "", $sqlQuery);

        echo $sqlQuery;
        $result = mysql_query($sqlQuery . mysql_error());

        if (!$result)
        {
            die('Invalid formation of Insert query in editInsertExec: ' . mysql_error());
        }

        mysql_close();

    header("Location: list.php?tablename=".$strTable."&action=list&key=".$strkey);
    ob_end_flush() ;    
    ?>

Quoted Text Here

    <?php
    ob_start();
     include("dataaccess.php"); ?>
    <?php 

    $strAction = "list";
        $num = "";
        $strTable = "";
        $strkey = "";


        if(!empty($_POST))
        {
        if (trim($strTable) == "" )
        {
            if ($_POST["tablename"] <> "")
                $strTable = $_POST["tablename"];
        }

        if (trim($strkey) == "" )
            $strkey = $_POST["key"];
        }

        dbConnect();
        $result = mysql_query("Select * from " . $strTable . mysql_error());

        if (!$result)
        {
            die('Invalid formation of Select query in editInsertExec: ' . mysql_error());
        }

        $columns = mysql_num_fields($result);

        $sqlQuery = "INSERT INTO " . $strTable . " (";
        for ($i = 0; $i <= mysql_num_fields($result); $i++) 
        {      
                 if ( mysql_field_name($result, $i) <> $strkey)
                 {  
                 $sqlQuery = $sqlQuery . mysql_field_name($result, $i);
                 if ($i < mysql_num_fields($result)-1)
                    $sqlQuery = $sqlQuery . ", ";       
                }   
        }

        $sqlQuery = $sqlQuery . ") VALUES (" ;

        for ($i = 0; $i <= mysql_num_fields($result); $i++) 
        {   
             if ( mysql_field_name($result, $i) <> $strkey)
                 {
                    $sqlQuery = $sqlQuery . "'" .$_POST[mysql_field_name($result, $i)] . "'" ;
                    if ($i < mysql_num_fields($result)-1)
                            $sqlQuery = $sqlQuery . ", ";
                }
        }



        $sqlQuery = $sqlQuery . ")";

        $sqlQuery = str_replace("''", "", $sqlQuery);

        echo $sqlQuery;
        $result = mysql_query($sqlQuery . mysql_error());

        if (!$result)
        {
            die('Invalid formation of Insert query in editInsertExec: ' . mysql_error());
        }

        mysql_close();

    header("Location: list.php?tablename=".$strTable."&action=list&key=".$strkey);
    ob_end_flush() ;    
    ?>
Edited by janguyo because: Had missed out error source
  • 2 Contributors
  • 1 Reply
  • 203 Views
  • 1 Hour Discussion Span
  • Latest Post Latest Post by pritaeas

Dani AI

Generated

Immediate, practical notes and a short checklist to get this working reliably.

is right to flag the call that mixes mysql_error() into the SQL string — mysql_error() returns the last MySQL error text and should be used after a failing query, not appended to the SQL you send. Also verify that $strTable is actually set before calling SELECT (an empty table name will produce a MySQL syntax error). See the mysql_error() docs for how that function behaves. (php.net)

Other problems to fix before re-running anything: the code uses the old mysql_* API (deprecated/removed in modern PHP), constructs SQL by string concatenation (SQL‑injection risk), and iterates fields with an off‑by‑one loop so mysql_field_name() can be asked for an invalid index (field offsets start at 0). Validate/whitelist the table and column names, and stop concatenating raw POST data into SQL. For the field-index details see mysql_field_name() and for injection prevention see the OWASP guidance. ()

Safer pattern (short): switch to PDO or mysqli, build a whitelist of allowed columns/tables, then prepare a parameterized INSERT for the values only. Note: parameter markers cannot be used for identifiers (table/column names) — those must be validated and inserted into the SQL string first. Example (conceptual):

// $cols validated from a whitelist, $table validated from a whitelist
$placeholders = implode(',', array_fill(0, count($cols), '?'));
$sql = "INSERT INTO `$table` (" . implode(',', array_map(function($c){ return "`$c`"; }, $cols)) . ") VALUES ($placeholders)";
$stmt = $pdo->prepare($sql);
$stmt->execute($valuesArray);

See PDO::prepare for parameter rules and examples. ()

Quick troubleshooting checklist: 1) var_dump/echo $strTable and the generated SQL before executing it; 2) run the echoed SQL directly in the MySQL client to get the exact error; 3) change loops to use < mysql_num_fields(...) so you don’t request an out‑of‑range field; 4) migrate to PDO/mysqli and use exceptions or or die()-style error checks while you debug. These steps will expose the real cause and make the code safer and future‑proof. (php.net)

Member Avatar for pritaeas

$result = mysql_query("Select * from " . $strTable . mysql_error());//this is the error source

Should be:

$result = mysql_query("Select * from " . $strTable) or die(mysql_error());
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.