Question

I have a simple messaging script that allows the Admin to send pre-defined messages to the users.

The two fields that seem to prevent the query from completion are the subject and body – the formats within the database are both ‘text’ with default set to NULL. Correlation has been set to latin1_swedish_ci for some reason.

I know these are the error’s as if I make them NULL when inserting them into the database, the entire query is successful.

The query is triggered on a button press (The fault isn’t here as I have queries above that work perfectly).

The two variables are defined as such:

$subject = "You have a new message!";
$body    = "<a href='?page=update'>click here to see it.</a>";

With the mysql query following:

mysql_query("INSERT INTO message VALUES(NULL, '$user_id', '$list_id', $subject , $body, '0', '$query_date_user', '1')");

I have seen a few tutorials on messaging scripts and they all appear to not have any other factors that i have missed out.

Any help would be hugely appreciated.

Many thanks in advance.

Answer 1

You’re causing a syntax error with the single quotes (') in your $body variable. Since you don’t have any error handling on the query call, you will not see the messages mysql would be screaming at you.

Your code should be:

$subject = mysql_real_escape_string("You have a new message!");
$body    = mysql_real_escape_string("<a href='?page=update'>click here to see it.</a>");
$sql = "INSERT INTO message VALUES(NULL, '$user_id', '$list_id', '$subject' , '$body', '0', '$query_date_user', '1')";
mysql_query($sql) or die(mysql_error());

Note the quotes around the variables inside the query string as well. You cannot insert a raw string into an SQL query and expect it to work.

BIG NOTE: adding or die(mysql_error()) during your development process helps catch these kinds of errors. If’d you been doing this from the get-go, you’d have seen immediately that there’s a problem.