PHP mysql_query Syntax Error

Question

<?php
mysql_connect("localhost","root","");
mysql_select_db("hftwmvirtualdb");
$Booknum = mysql_real_escape_string($_POST['Booknum']); 
$Chapternum = mysql_real_escape_string($_POST['Chapternum']); 
$Versenum = mysql_real_escape_string($_POST['Versenum']); 
$sql = mysql_query("SELECT `VERSETEXT` FROM `booktable` WHERE `BOOKID` = $Booknum AND `CHAPTERID` = $Chapternum AND `VERSENO` = $Versenum");
echo mysql_error();
while($row=mysql_fetch_assoc($sql));
print(json_encode($row));
mysql_close();
?>

I am trying to use posted data from an android application to trigger a query and retrieve the results from the mysql database. The Table has 4 columns, and I'm trying to retrieve the value in the third column by defining the values in the first 3 columns. Each time i clicked the button, I get the parsing error to find out my PHP script was not processing the SQL query. When running the scriptthrough the browser I get the messages:

• Undefined index: Booknum in C:\\wamp\\www\\GetVerse.php on line 4
• Undefined index: Chapternum in C:\\wamp\\www\\GetVerse.php on line 5
• Notice: Undefined index: Versenum in C:\\wamp\\www\\GetVerse.php on line 6
• You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'AND CHAPTERID = AND VERSENO =' at line 1
• Warning: mysql_fetch_assoc() expects parameter 1 to be resource, boolean given in C:\\wamp\\www\\GetVerse.php on line 9.

I understand i get the warning messages 1-3 is because I did not submit the post data but the latter I don't know how to fix as I have tried using the correct syntax, I tried removing "=" for "like" and that failed also. What is the problem?.

Answer 1

The undefined index errors are, as you specified, occurring because you did not submit the post data. This, in turn, is causing the variables $Booknum , $Chapternum , and $Versenum to be empty.

With the empty variables, the MySQL query is being generated with a WHERE clause like:

WHERE `BOOKID` =  AND `CHAPTERID` =  AND ...

The missing values are causing invalid MySQL, hence your error. Additionally, as you've specified (in a comment) that the POST-values are strings (and not integers which is what I would have assumed based on their usage and names), you have to wrap the values in quotes in your MySQL query too. If you do not wrap the values in quotes, even valid strings may cause the query to fail.

To fix this, try something like:

$Booknum = isset($_POST['Booknum']) ? mysql_real_escape_string(trim($_POST['Booknum'])) : null;
$Chapternum = isset($_POST['Chapternum']) ? mysql_real_escape_string(trim($_POST['Chapternum'])) : null;
$Versenum = isset($_POST['Versenum']) ? mysql_real_escape_string(trim($_POST['Versenum'])) : null;
if (!empty($Booknum) && !empty($Chapternum) && !empty($Versenum)) {
    $sql = mysql_query("SELECT `VERSETEXT` FROM `booktable` WHERE `BOOKID` = '" . $Booknum . "' AND `CHAPTERID` = '" . $Chapternum . "' AND `VERSENO` = '" . $Versenum . "'");
    echo mysql_error();
    while($row=mysql_fetch_assoc($sql));
    print(json_encode($row));
    mysql_close();
}

This will verify that the values are properly set - if not, they will be set to null . If all three values are not empty, via PHP's empty() , your query will be executed.

Answer 2

The "undefined index" messages you're getting are because those variables are not set. Check that you're actually posting those to the script.

The empty variables are why your query is wrong and you get an error.

Consider using PDO as the "mysql_" commands are deprecated. You should check your inputs before passing them to the query. isset() will work for that.

Answer 3

This is what your SQL query will look like when the variables are substituted in:

SELECT `VERSETEXT` FROM `booktable` WHERE `BOOKID` =  AND `CHAPTERID` =  AND `VERSENO` = 

When the variables contain no content (as they won't if you submit no data), the query is meaningless: the syntax is malformed.

Check whether the data is posted before doing the query. Moreover, it will also profit you to start using parameterised queries (using MySQLi or PDO) for security and convenience.

Answer 4

CHeck whether the Post data is coming or not, undefined index it is because, there is no data for the variables you have used. SO first verify it and then execte the SQL query.

if(isset($_POST['Booknum']) && isset($_POST['Chapternum']) && isset($_POST['Versenum']))
 {
   $Booknum = mysql_real_escape_string($_POST['Booknum']); 
   $Chapternum = mysql_real_escape_string($_POST['Chapternum']); 
   $Versenum = mysql_real_escape_string($_POST['Versenum']); 
   $sql = mysql_query("SELECT `VERSETEXT` FROM `booktable` WHERE `BOOKID` = $Booknum AND    `CHAPTERID` = $Chapternum AND `VERSENO` = $Versenum");
   echo mysql_error();
   while($row=mysql_fetch_assoc($sql));
   print(json_encode($row));
  }
else
{
 echo "No post data";
 }