0 
 $threadID=$_GET['threadID']; $result=mysql_query(" SELECT * FROM threads AS Threads INNER JOIN users AS Users ON Threads.user_id=Users.user_id WHERE thread_id='$threadID' LIMIT 1 ") or die(mysql_error());

I get this:

u have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''11' at line 3

I wrote many inner joins before. Why is my syntax wrong near the end of the query

updated: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '12' LIMIT 1' at line 3

Improve this question
6
  • Can you echo the complete query (or at least the value of $threadID)? It looks like $threadID might be set to '11 (with a leading single-quote) for some reason. Commented Oct 23, 2011 at 15:47
  • it says exactly like this - "u have.."? Commented Oct 23, 2011 at 15:48
  • @Col: must be Oracle's new 'MySQL, teenager edition'. Comes in 12 hip colors and all output converted into txt/l33t. Commented Oct 23, 2011 at 15:53
  • lol..no you have. do i put echo on the result.. Commented Oct 23, 2011 at 15:55
  • You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '12' LIMIT 1' at line 3 Commented Oct 23, 2011 at 15:57

3 Answers 3

Reset to default
3

First of all, your query is WIDE open to sql injection attacks.

Second, to figure out why you get the syntax error, make the query building phase separate from the actual query call:

$sql = "SELECT ...."; echo $sql; $result = mysql_query($sql) or die(...);

This way you can see the entire query. MySQL's error messages only report the portion of the query from where it thinks the error is onwards, but sometimes it decides wrong and elminates the actual relevant part where th error is... so... examine the ENTIRE query.

Improve this answer
Sign up to request clarification or add additional context in comments.

14 Comments

Up-vote for mentioning SQL injection. It's easy to avoid, but easy to ignore.
What do you want me to check? whether the request came from the previous page. I do need to send the threadID by GET.. although I could do it by post too.. it is convenient to send some ids by get..
@Matrix001 This doesn't answer your primary question, but it will help stop SQL Injection. Since the 'threadID' query string parameter could be set to anything (like 1'; DROP TABLE threads; --, for example), you should use prepared statements with parameters. In PHP this is supported through MySQLi.
Matrix: you HAVE to sanitize user input before inserting it into an SQL string. Usually that's done with mysql_real_escape_string(). In your case, since it seems strict mode is on, you'd have to do eliminate the quotes around the value in the query, and force it to be an int in PHP via $threadID = intval($_GET['threadID']);
@Matrix001 don't listen to him, this is not truth. You don't have to "sanitize" user input. You have to format your data according to SQL rules. ALWAYS. No matter if it's user input or not. And it's not a sanitizing but merely a formatting. and mysql_real_escape_string() doesn't "sanitize" anything as well.
|
1

ah, may be I know the answer.
There is a thing in mysql, i believe, called "strict mode" or something, which being too picky about data types.

Try to make your query like this

 $id = (int)$_GET['threadID']; $sql = "SELECT * FROM threads t INNER JOIN users u ON t.user_id=u.user_id WHERE thread_id=$id LIMIT 1"; $res = mysql_query($sql) or trigger_error(mysql_error().$sql);
Improve this answer

1 Comment

hmm..interesting syntax near the end.. thank you for that line..I will use it from now on
0

Why not join your query in this fashion:

$threadID = mysql_real_escape_string( $_REQUEST['threadID'] ); // Get some cleanup in there... $result=mysql_query("SELECT threads.*, users.* FROM threads, users WHERE threads.user_id = users.user_id AND threads.thread_id = '$threadID' LIMIT 1 ") or die( mysql_error() );
Improve this answer

1 Comment

lol..perhaps it means the same thing and a bit shorter. I am thinking of using this syntax which is shortest ... USING(users.user_id),, interesting syntax, you have shown

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.