Welcome, Guest. Please login or register.
Did you miss your activation email?
May 24, 2012, 08:54:49 PM

Login with username, password and session length
Search:     Advanced search
Wollen Sie dem WebsiteBaker Team beitreten?
Nähere Informationen finden Sie unter hier und auf unserer neuen Webseite.
155469 Posts in 21707 Topics by 7732 Members
Latest Member: DarrellDD
* Home Help Search Login Register
Pages: [1]   Go Down
Print
Author Topic: Code error in modual any advice  (Read 686 times)
4nthony

Offline Offline

Posts: 13


« on: December 02, 2008, 09:14:05 PM »

I dont know if im in the right section :s

Hay guys im trying to edit the team modual to suit what im after basicaly well i have now encountered a problem and can not seem to find the fix for it.

The modual installed fine and the tables have all installed aswell

but when i try and save the team member i get the following error

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'from = 't', dob = 't', intfact = 't', camfrog = 't', favemusic = 't', m_ext' at line 1

Now i have checked the code and can not seem to find any thing wrong with it Personaly.

I am still learning about php and sql and this is how i learn by experimentation.

i have tracked the problem to the save_member.php file but from there i am confused.

Code:
<?php

/*

 WebsiteBaker Project <http://www.websitebaker.org/>
 Copyright (C) 2004-2007, Ryan Djurovich

 WebsiteBaker is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.

 WebsiteBaker is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.

 You should have received a copy of the GNU General Public License
 along with websitebaker; if not, write to the Free Software
 Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

*/

require('../../config.php');

// Get id
if(!isset($_POST['team_id']) OR !is_numeric($_POST['team_id'])) {
    
header("Location: ".ADMIN_URL."/pages/index.php");
} else {
    
$team_id $_POST['team_id'];
}

global 
$wb;
// Include WB admin wrapper script
$update_when_modified true// Tells script to update when this page was last updated
require(WB_PATH.'/modules/admin.php');

// Validate  fields
if($admin->get_post('m_name') == '') {
    
$admin->print_error($MESSAGE['GENERIC']['FILL_IN_ALL'], WB_URL.'/modules/modify_member.php?page_id='.$page_id.'&section_id='.$section_id.'&team_id='.$team_id);
} else {

    
$html_allowed 0;
    require(
'module_settings.php');
    
    
$m_sort addslashes(strip_tags($admin->get_post('m_sort')));
    
$picture addslashes(strip_tags($admin->get_post('picture')));
    
$group addslashes(strip_tags($admin->get_post('group')));
    
$active addslashes(strip_tags($admin->get_post('active')));
    
$email addslashes(strip_tags($admin->get_post('email')));
    
    
$m_name $admin->get_post('m_name');
    
$m_capacity $admin->get_post('m_capacity');
    
$description $admin->get_post('description');
    
$phone $admin->get_post('phone');
    
$from $admin->get_post('from');
    
$dob $admin->get_post('dob');    
    
$intfact $admin->get_post('intfact');
    
$camfrog $admin->get_post('camfrog');
    
$favemusic $admin->get_post('favemusic');
    
$m_extra1 $admin->get_post('m_extra1');
    
$m_extra2 $admin->get_post('m_extra2');
    
    
$m_searchstring $m_name.' '.$m_capacity.' '.$description.' '.$m_extra1.' '.$m_extra2;
    
$m_searchstring addslashes(strip_tags($m_searchstring));
    
    
    if (
$html_allowed != 1) {
        
$m_name my_htmlspecialchars($m_name);
        
$m_capacity my_htmlspecialchars($m_capacity);
        
$description my_htmlspecialchars($description);    
        
$phone my_htmlspecialchars($phone);
        
$m_extra1 my_htmlspecialchars($m_extra1);
        
$m_extra2 my_htmlspecialchars($m_extra2);    
    }
    
    
    
    
$m_name addslashes($m_name);
    
$m_capacity addslashes($m_capacity);
    
$description addslashes($description);
    
$phone addslashes($phone);
    
$from addslashes($from);    
    
$dob addslashes($dob);
    
$intfact addslashes($intfact);
    
$camfrog addslashes($camfrog);
    
$favemusic addslashes($favemusic);
    
$m_extra1 addslashes($m_extra1);
    
$m_extra2 addslashes($m_extra2);
    
    
}

// Update row
$database->query("UPDATE ".TABLE_PREFIX."mod_team_members SET "
                    
" group_id = '$group', "
                    
" m_sort = '$m_sort', "
                    
" m_name = '$m_name', "
                    
" m_capacity = '$m_capacity', "
                    
" description = '$description', "
                    
" email = '$email', "
                    
" phone = '$phone', "
                    
" from = '$from', "
                    
" dob = '$dob', "
                    
" intfact = '$intfact', "
                    
" camfrog = '$camfrog', "
                    
" favemusic = '$favemusic', "
                    
" m_extra1 = '$m_extra1', "
                    
" m_extra2 = '$m_extra2', "
                    
" active = '$active', "
                    
" picture = '$picture', "
                    
" m_searchstring = '$m_searchstring' "
                    
" WHERE team_id = '$team_id'");

// Check if there is a db error, otherwise say successful
if($database->is_error()) {
    
$admin->print_error($database->get_error(), WB_URL.'/modules/team/modify_member.php?page_id='.$page_id.'&section_id='.$section_id.'&team_id='.$team_id);
} else {
    
$admin->print_success($TEXT['SUCCESS'], ADMIN_URL.'/pages/modify.php?page_id='.$page_id);
}

// Print admin footer
$admin->print_footer();

?>

Now i have moved the syntax around i have put them in the order they are in the sql table yet still i get the same error. can anyone assist if so that would be great.

Attatched is also a copy of the eddited zip file.

Anthony
Logged
thorn

Offline Offline

Posts: 980


WWW
« Reply #1 on: December 02, 2008, 10:51:33 PM »

Hello,

from is a reserved word in SQL. `from` should do.

thorn.
Logged

4nthony

Offline Offline

Posts: 13


« Reply #2 on: December 02, 2008, 11:12:53 PM »

nop no good still man

i change from to where

still getting

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'where = 'Italy', dob = 'test', intfact = 'I like italy', camfrog = '', ' at line 1

this is realy confusing as i am running the latest version of my sql :S and the syntax is the same as the rest.

Very strange indeed
Logged
thorn

Offline Offline

Posts: 980


WWW
« Reply #3 on: December 02, 2008, 11:36:02 PM »

Hello,

Quote
i change from to where
cool

where is a reserved word, too.
Think about using ` for all fieldnames.

EDIT:
BTW: you should use $admin->strip_slashes before using addslashes() on all $_POST-Vars, that is e.g.:
Code:
$m_sort = addslashes(strip_tags($admin->strip_slashes($admin->get_post('m_sort'))));
Code:
$m_name = $admin->strip_slashes($admin->get_post('m_name'));
...
$m_name = addslashes($m_name);
Example I (magic-quotes-gpc on):
User-inputo'reilly
echo $admin->get_post('user_input');o\'reilly
echo addslashes($admin->get_post('user_input'));o\\\'reilly
becomes in database:o\'reilly   sad
--------------------------------------------------------------------------------------------------
User-inputo'reilly
echo $admin->strip_slashes($admin->get_post('user_input'));o'reilly
echo addslashes($admin->strip_slashes($admin->get_post('user_input')));o\'reilly
becomes in database:o'reilly   smiley

Example II (magic-quotes-gpc off):
User-inputo'reilly
echo $admin->get_post('user_input');o'reilly
echo addslashes($admin->get_post('user_input'));o\'reilly
becomes in database:o'reilly   smiley
--------------------------------------------------------------------------------------------------
User-inputo'reilly
echo $admin->strip_slashes($admin->get_post('user_input'));o'reilly
echo addslashes($admin->strip_slashes($admin->get_post('user_input')));o\'reilly
becomes in database:o'reilly   smiley

Although this may work on yours server (with magic-quotes-gpc off), it may break user-input on a different server (with magic-quotes-gpc on).


thorn.
« Last Edit: December 03, 2008, 12:12:09 AM by thorn » Logged

4nthony

Offline Offline

Posts: 13


« Reply #4 on: December 03, 2008, 12:11:03 AM »

Thanks man i have now made thoughs changes and i am on new problems.

just isent my day today. the view.php has disided to not display.

P.s i aploise for my spelling guys im abit dislexic lol

Anyway this code is origionaly from the team code im editing it to suit my needs.

thanks again man  grin grin grin

Edit:
All is working now thak you thorn for all your help man Cheesy

One question should i send it to the origional creator once i have finished it.
« Last Edit: December 03, 2008, 01:18:14 AM by 4nthony » Logged
Pages: [1]   Go Up
Print
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.16 | SMF © 2011, Simple Machines Valid XHTML 1.0! Valid CSS!