I have a form that updates a MySQL database. Standard stuff. But when
my data has a comma, I get this error:

"You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use
near 's'' at line 1"

But it's not what you are thinking. I have handled the apostrophe
every way I can think of. I have used addslashes, I have replaced '
with \' etc. I still get the error.

What's odd is that, despite the error, the data does go into the
database correctly. Also, when I echo the SQL statement to the page,
copy it and paste it directly into MySQL, it works fine with no
errors. And for what it's worth, when I put an escape directly in the
form field (e.g. I type Shane\'s) it works fine.

I'm using PHP 4.4.4 on a shared server. I don't know what version of
MySQL they are running.

Any ideas? Thanks in advance.

J. Cairn wrote:
> I have a form that updates a MySQL database. Standard stuff. But when
> my data has a comma, I get this error:
>
> "You have an error in your SQL syntax; check the manual that
> corresponds to your MySQL server version for the right syntax to use
> near 's'' at line 1"
>
> But it's not what you are thinking. I have handled the apostrophe
> every way I can think of. I have used addslashes, I have replaced '
> with \' etc. I still get the error.
>
> What's odd is that, despite the error, the data does go into the
> database correctly. Also, when I echo the SQL statement to the page,
> copy it and paste it directly into MySQL, it works fine with no
> errors. And for what it's worth, when I put an escape directly in the
> form field (e.g. I type Shane\'s) it works fine.
>
> I'm using PHP 4.4.4 on a shared server. I don't know what version of
> MySQL they are running.
>
> Any ideas? Thanks in advance.
>

Can you please supply copy of code?

Have you tried mysql_real_escape_string ??

I have tried that. Here is the code:

if($_REQUEST[name] != null){

$textToInsert = addslashes($_REQUEST[name]);

$sql = "UPDATE organization SET name = '$textToInsert'";

if($_REQUEST[description] == ""){
$sql = $sql . ", description = null ";
} else {
$sql = $sql . ", description = '" . $_REQUEST[description] . "'";
}

if($_REQUEST[phone] == ""){
$sql = $sql . ",phone = null ";
} else {
$sql = $sql . ",phone = '" . $_REQUEST[phone] . "'";
}

if($_REQUEST[url] == ""){
$sql = $sql . ",url = null ";
} else {
$sql = $sql . ",url = '" .$_REQUEST[url] . "'";
}

if($_REQUEST[categoryList] == ""){
$sql = $sql . ",catId = null";
} else {
$sql = $sql . ",catId = '" . $_REQUEST[categoryList] . "'";
}
$sql = $sql . " where id = " . $_REQUEST[id];

I figured it out. Stupid mistake on my part.

"J. Cairn" <jcairn [at] clearhelp.com> wrote in message
news:1176164681.847942.308430 [at] y80g2000hsf.googlegroups.com.. .
> I figured it out. Stupid mistake on my part.
>
Missing append operators?