How to put parentheses in MySQL?

[jabird]

I have a mysql query like:

$where = "INSERT INTO news
    (author, date, newstitle, newstext, category) VALUES (
    'Sample',
    'NOW()',
    'Where am I?',
    'I was built in a small town, that is called, Dongola. By someone who goes by the name of Ja (imagine a y at the end of that, and you'll know how to pronounce it). His real name is Jacob, and he works for a familly owned computer store named, C & S Consulting. Ja, was 15 years old when this part here was typed, but 16 days after that, he would turn 16. I know, I know, the section was titled "Where am I?" but I got carried away, and most of this should have been in the "About" section, but what I put there, had nothing to do with "About" but I put it there anyway.',
    'index'
    )"; 

I've tried changing the ('s and )'s to ( and ) but when I load the page, the html codes get changed back to ('s and )'s and then tried to be put into the database... this is causing problems, because mysql thinks its done, and doesn't know what to do with the rest of it, so I get a big nasty error...

[spikeZ]

look up mysql_escape_string()
also you dont need quotes around NOW() as it is a mysql term.

Cheers

SpikeZ

[jabird]

Does NOW have to be in quotes?

[spikeZ]

Nope.
It's part of mysql's functions.

[jabird]

Ok so for mysql_escape_string I need:

mysql_escape_string($where = "INSERT INTO news
(author, date, newstitle, newstext, category) VALUES (
'Sample',
NOW,
'Where am I?',
'I was built in a small town, that is called, Dongola. By someone who goes by the name of Ja (imagine a y at the end of that, and you'll know how to pronounce it). His real name is Jacob, and he works for a familly owned computer store named, C & S Consulting. Ja, was 15 years old when this part here was typed, but 16 days after that, he would turn 16. I know, I know, the section was titled "Where am I?" but I got carried away, and most of this should have been in the "About" section, but what I put there, had nothing to do with "About" but I put it there anyway.',
'index'
)");

instead of my old one?

or do I need to make another variable:

$where_escaped = "mysql_escape_string($where)";

and then mysql_query($where_escaped)

?

[spikeZ]

make another variable...
$where_escaped = "mysql_escape_string($where)";

and then mysql_query($where_escaped)

[jabird]

owch, now I get a bunch of errors similar to this:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'mysql_escape_string(INSERT INTO news
(author, date, newstitle, newstext, catego' at line 1

[klik]

Why is mysql_escape_string directly before the sql statement?

Make new variables from this function, and then use the standard procedure of updating the database.

[jabird]

My code is:

$what = "INSERT INTO news
    (author, date, newstitle, newstext, category) 
    VALUES ( 
    'Sample', 
    NOW, 
    'What to do next...',
    'Well I\'m assuming you\'re the admin, so if you are, incase you haven\'t noticed... Your site is pretty uhmmm bland? If you want to fix that, go back to the documentation I\'m sure you followed to get this far, and go to the next section. That should teach you how to delete me, or change me. And the section after that, teaches you how to make me \'pretty\'.</p><p>Also, if you ever get to a point where you just can\'t go any farther, or don\'t feel like learning this, you can always contact me...contact information provided at <a href=\'http://www.jabird.com\'>my website</a>, and I would gladly give you a quote, or do it for free, depending on the complexity of it.', 'index')";
$what_escaped = "mysql_escape_string($what)";
if(mysql_query($what_escaped)) {
    echo("The 'What to do next...' entry was successfull!<br />");
} else {
    echo("For some reason we could not enter the 'What to do next...' entry to the database.<br />The error we received was:<br /><textarea cols='40' rows='5'>".mysql_error()."</textarea><br /><br />");
    $whatfail = "DELETE FROM news";
} 

I think its basically including the $where varialbe into the $where_escaped variable, and stripping the wrong ('s and )'s...

[Dylan B]

Is DATE a reserved MySQL word?

[spikeZ]

Is DATE a reserved MySQL word?

Yep, spot on Dylan_B. You would be advised to change it to something like date_added....

$what = "INSERT INTO news 
    (author, date, newstitle, newstext, category) 
    VALUES ( 
    'Sample', 
    NOW, 
    'What to do next...', 
    'Well I\'m assuming you\'re the admin, so if you are, incase you haven\'t noticed... Your site is pretty uhmmm bland? If you want to fix that, go back to the documentation I\'m sure you followed to get this far, and go to the next section. That should teach you how to delete me, or change me. And the section after that, teaches you how to make me \'pretty\'.</p><p>Also, if you ever get to a point where you just can\'t go any farther, or don\'t feel like learning this, you can always contact me...contact information provided at <a href=\'http://www.jabird.com\'>my website</a>, and I would gladly give you a quote, or do it for free, depending on the complexity of it.', 'index')"; 
$what_escaped = mysql_escape_string($what); 
if(mysql_query($what_escaped)) { 
    echo("The 'What to do next...' entry was successfull!<br />"); 
} else { 
    echo("For some reason we could not enter the 'What to do next...' entry to the database.<br />The error we received was:<br /><textarea cols='40' rows='5'>".mysql_error()."</textarea><br /><br />"); 
    $whatfail = "DELETE FROM news"; 
} 

mysql_escape_string is a function and therefore doesn't need quotes.

Mike

[jabird]

Now I get:

 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\n	(author, date, newstitle, newstext, category)\n	VALUES (\n	\'Sample\' at line 1

is perhaps mysql_escape_string perhaps escaping too much?

[klik]

You haven't changed date to date_added...

[jabird]

Why would I?

in MySQL the row name is date...

[klik]

Didn't you read Dylan's post?

It is a mysql reserve word. You'll have to change the date column name to date_added as suggested by Spikez.

[jabird]

ah, sorry about that =\

I changed that though, now I get:

 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\n	(author, date_added, newstitle, newstext, category) VALUES (\n	\'Sample' at line 1

[klik]

Paste your current code into here, for the query.

[jabird]

  $what = "INSERT INTO news
     (author, date_added, newstitle, newstext, category)
     VALUES (
     'Sample',
     NOW,
     'What to do next...',
     'Well I\'m assuming you\'re the admin, so if you are, incase you haven\'t noticed... Your site is pretty uhmmm bland? If you want to fix that, go back to the documentation I\'m sure you followed to get this far, and go to the next section. That should teach you how to delete me, or change me. And the section after that, teaches you how to make me \'pretty\'.</p><p>Also, if you ever get to a point where you just can\'t go any farther, or don\'t feel like learning this, you can always contact me...contact information provided at <a href=\'http://www.jabird.com\'>my website</a>, and I would gladly give you a quote, or do it for free, depending on the complexity of it.', 'index')";
 $what_escaped = mysql_escape_string($what);
 if(mysql_query($what_escaped)) {
     echo("The 'What to do next...' entry was successfull!<br />");
 } else {
     echo("For some reason we could not enter the 'What to do next...' entry to the database.<br />The error we received was:<br /><textarea cols='40' rows='5'>".mysql_error()."</textarea><br /><br />");
     $whatfail = "DELETE FROM news";
 } 

[Opserty]

Isn't NOW meant to have a set of brackets after it, like NOW() ?

[jabird]

Nope, I was told to remove them..

[jabird]

Are there any errors in there? I still think the mysql_escape_string is escaping EVERYTHING not just the stuff I want escaped...

[jabird]

This would be a huge pain, but I was thinking something like:

 $author = 'Sample';
 $title = 'What to do next...';
 $content = 'Content (here)';
 $contentescaped = mysql_escape_string($content);
 $category = 'index';
 $what = "INSERT INTO news
     (author, date_added, newstitle, newstext, category)
     VALUES (
     '$author',
     NOW,
     '$title',
     '$contentescaped',
     '$category')"; 

[jabird]

I fixed it... I feel dumb now

[Dylan B]

I fixed it... I feel dumb now

What was the error?

[jabird]

I just changed the query from my old one to:

 $what = "INSERT INTO news SET
     author = 'Sample',
     date_added = NOW(),
     newstitle = 'What to do next...',
     newstext = 'Well I\'m assuming you\'re the admin, so if you are, incase you haven\'t noticed... Your site is pretty uhmmm bland? If you want to fix that, go back to the documentation I\'m sure you followed to get this far, and go to the next section. That should teach you how to delete me, or change me. And the section after that, teaches you how to make me \'pretty\'.</p><p>Also, if you ever get to a point where you just can\'t go any farther, or don\'t feel like learning this, you can always contact me...contact information provided at <a href=\'http://www.jabird.com\'>my website</a>, and I would gladly give you a quote, or do it for free, depending on the complexity of it.', 
     category = 'index'
     "; 

Thus eliminating the ('s and )'s from screwing with my query...