tags:

views:

82

answers:

3

So this might be dumb, but I can't get anything to insert into a MySQL on a certain account, and I've been staring at this for two hours. I'm a newbie to PHP, so I could very well be doing something dumb. I attached a screen shot of the DB I am trying to INSERT INTO.

Find an image of what I'm talking about at http://dillondoyle.com/files/dbsetup.jpg (imgur seems to be down for me)

Here's the code I have, and PhpMyAdmin told me GRANT ALL PRIVILEGES ON . TO ...

$fbFirstName = $me['first_name'];
$fbLastName = $me['last_name'];
$fbEmail = $me['email'];
mysql_real_escape_string($fbFirstName,$fbLastName,$fbEmail);

$getuserresult = mysql_query("SELECT * FROM newusers WHERE fbUID=$uid");
$userrowsreturned=mysql_num_rows($getuserresult);
if ($userrowsreturned=0)
  { 
        echo '<br />user already exists, will update something here eventually<br />';
  }
else {
        $sql = mysql_query("INSERT INTO newusers (fbUID,callsAttempted,callsMade,fbEmail,fbFirstName,fbLastName) VALUES ($uid,'1','0',$fbEmail,$fbFirstName,$fbLastName)"); 
        if(!$sql) {
            die("Nope");
        } else {
            echo "1 record added";
        }
        echo '<br />created user<br />';
}
+3  A: 

Two things go wrong here. Escaping goes like:

$fbFirstName = mysql_real_escape_string($fbFirstName);
// for all variables

// or, just in one go:
$fbFirstName = mysql_real_escape_string($me['first_name']);

// and for integers, make sure they are actually integers (and prevent mayhem)
$some_id = (int)$me['some_id'];
$uid = (int)$uid;

And when inserting you must quote non-integer values:

$sql = mysql_query("INSERT INTO `newusers`
     (`fbUID`,`callsAttempted`,`callsMade`,`fbEmail`,`fbFirstName`,`fbLastName`)
     VALUES
     ('$uid',1,0,'$fbEmail','$fbFirstName',$fbLastName')"); 

(but you may quote integers as well - you never know if some external id is, or may become, alphanumeric.)

mvds
It is amazing that feeding `mysql_real_escape_string` incorrect parameter data types as well as one more parameter than it's documented as accepting isn't fatal.
BipedalShark
Brilliant! Thanks for the help. Gradually learning. I will mark this as correct when it allows me to in 3 minutes! THANKS!
Dillon Doyle
great. I gave some more background you should know about, such as casting of integer values (forcing them to be numbers only) and quoting field/table names in mysql. (for if you have a field named `order`, or `table` you will not run into hard to find bugs)
mvds
this function simplifies things: http://programanddesign.com/php/sql-injection-safe-queries-redux/
Mark
A: 

first of all you must change

$getuserresult = mysql_query("SELECT * FROM newusers WHERE fbUID=$uid");

to

$getuserresult = mysql_query("SELECT * FROM newusers WHERE fbUID='$uid'");

after that change your insert to:

$sql = mysql_query("INSERT INTO newusers (fbUID,callsAttempted,callsMade,fbEmail,fbFirstName,fbLastName) VALUES
     ('$uid','1','0','$fbEmail','$fbFirstName',$fbLastName')"); 
Am1rr3zA
+2  A: 

You have an error

if ($userrowsreturned=0)

should be (use double equals to test equivalence, single equals for assignment)

if ($userrowsreturned==0)

I also think you actually mean the following since you're checking if a user already exists

if ($userrowsreturned==1) 
acqu13sce