Question

I’m trying to assign an incremented id (posid) for each link a user adds to their profile, specific to their id in the table. This is what I have and it does not seem to be working. What is wrong? Do I have my syntax wrong?

mysql_query("INSERT INTO userlinks (id,hash,url,title,posid)
             VALUES (
                 '".$_SESSION['id']."',
                 '".md5($_GET['url'])."',
                 '".$_GET['url']."',
                 '".$_GET['title']."',
                 SELECT(IFNULL(SELECT MAX(posid)+1 FROM userlinks
             WHERE id='".$_SESSION['id']."'), 1)
           )");

Answer 1

If you’re not going to use prepared statements or PDO, use:

$query = sprintf("INSERT INTO userlinks
                    (id, hash, url, title, posid)
                  SELECT %s,
                         %s,
                         %s,
                         %s,
                         IFNULL(MAX(t.posid), 1)
                    FROM userlinks t
                   WHERE id = %s",
                  mysql_real_escape_string($_SESSION['id']),
                  MD5(mysql_real_escape_string($_SESSION['url'])),
                  mysql_real_escape_string($_GET['url']),
                  mysql_real_escape_string($_GET['title']),
                  mysql_real_escape_string($_SESSION['id']));

$result = mysql_query($query);

With an INSERT statement, you can’t mix a SELECT with the VALUES keywords — one or the other, and SELECT supports defining static values.

Secondly, the MAX(...) + 1 is not reliable in a multi-user situation — you should use the MySQL autoincrement functionality.

Reference:

• mysql_real_escape_string
• sprintf