Question

im having syntax errors thrown back at me when using mysqli_real_escape_string. The IDE that i am using shows no syntax issues, however this is the first time i have tried using this function with multiple CASE statements (infact i have not used this function very much at all).

The insertion code is here:

$query = "INSERT INTO `auctionwp_categories` 
         (`CategoryID`, `CategoryLevel`, `CategoryName`, `CategoryParentID`, `LeafCategory`, `AutoPayEnabled`, `BestOfferEnabled`, `Expired`, `IntlAutosFixedCat`, `Virtual`, `LSD`, `ORPA`)
  VALUES (
          '".mysqli_real_escape_string($link, $xmlCategoryID)."', '".mysqli_real_escape_string($link, $xmlCategoryLevel).", '".mysqli_real_escape_string($link, $xmlCategoryName).", '".mysqli_real_escape_string($link, $xmlCategoryParentID).",
          CASE '".mysqli_real_escape_string($link, $xmlLeafCategory)."' WHEN 'true' THEN 1 ELSE 0 END,
          CASE '".mysqli_real_escape_string($link, $xmlAutoPayEnabled)."' WHEN 'true' THEN 1 ELSE 0 END,
          CASE '".mysqli_real_escape_string($link, $xmlExpired)."' WHEN 'true' THEN 1 ELSE 0 END,
          CASE '".mysqli_real_escape_string($link, $xmlBestOfferEnabled)."' WHEN 'true' THEN 1 ELSE 0 END,
          CASE '".mysqli_real_escape_string($link, $xmlIntlAutosFixedCat)."' WHEN 'true' THEN 1 ELSE 0 END,
          CASE '".mysqli_real_escape_string($link, $xmlVirtual)."' WHEN 'true' THEN 1 ELSE 0 END,
          CASE '".mysqli_real_escape_string($link, $xmlLSD)."' WHEN 'true' THEN 1 ELSE 0 END,
          CASE '".mysqli_real_escape_string($link, $xmlORPA)."' WHEN 'true' THEN 1 ELSE 0 END
          )";

if (mysqli_query($link, $query)) {
echo "Successfully inserted " . mysqli_affected_rows($link) . " row";
} else {
echo "Error occurred: " . mysqli_error($link);
}

Connection to db is successfull via this code in a config file:

$user="root";
$pass="";
$database="auctionwp";
$server="localhost";

$link = mysqli_connect($server, $user, $pass, $database);

if (!$link) {
die('Connect Error (' . mysqli_connect_errno() . ') '
        . mysqli_connect_error());
}

echo 'Success... ' . mysqli_get_host_info($link) . "\n";

Is my problem of syntax due to the CASE statements? i can find no examples online or in php manual that show mysqli_real_escape_string being used on insertion with this statement,

regards
Martin

Answer 1

Thanks for your reply, before i had chance to see that someone had replied i managed to get it working keeping the CASE statements intact, it was actually quite easy once i got my head around it.
What i did was this:

// escape the returned values
$xmlCategoryName = mysqli_real_escape_string($link, $xmlCategoryName);
$xmlLeafCategory = mysqli_real_escape_string($link, $xmlLeafCategory);
$xmlBestOfferEnabled = mysqli_real_escape_string($link, $xmlBestOfferEnabled);
$xmlAutoPayEnabled = mysqli_real_escape_string($link, $xmlAutoPayEnabled);
$xmlExpired = mysqli_real_escape_string($link, $xmlExpired);
$xmlIntlAutosFixedCat = mysqli_real_escape_string($link, $xmlIntlAutosFixedCat);
$xmlVirtual = mysqli_real_escape_string($link, $xmlVirtual);
$xmlLSD = mysqli_real_escape_string($link, $xmllSD);
$xmlORPA = mysqli_real_escape_string($link, $xmlORPA);


// the insert query for the values
$query = "INSERT INTO `auctionwp_categories` 
         (`CategoryID`, `CategoryLevel`, `CategoryName`, `CategoryParentID`, `LeafCategory`, `AutoPayEnabled`, `BestOfferEnabled`, `Expired`, `IntlAutosFixedCat`, `Virtual`, `LSD`, `ORPA`)
  VALUES (
          '".$xmlCategoryID."', '".$xmlCategoryLevel."', '".$xmlCategoryName."', '".$xmlCategoryParentID."',
          CASE '$xmlLeafCategory' WHEN 'true' THEN 1 ELSE 0 END,
          CASE '$xmlAutoPayEnabled' WHEN 'true' THEN 1 ELSE 0 END,
          CASE '$xmlExpired' WHEN 'true' THEN 1 ELSE 0 END,
          CASE '$xmlBestOfferEnabled' WHEN 'true' THEN 1 ELSE 0 END,
          CASE '$xmlIntlAutosFixedCat' WHEN 'true' THEN 1 ELSE 0 END,
          CASE '$xmlVirtual' WHEN 'true' THEN 1 ELSE 0 END,
          CASE '$xmlLSD' WHEN 'true' THEN 1 ELSE 0 END,
          CASE '$xmlORPA' WHEN 'true' THEN 1 ELSE 0 END
          )";

All seems to be working right now as required.