Question

I’m trying to setup a very simple email tracking pixel…it’s proving to be less simple than I had originally expected.

My server is running linux and mysql v. 5.1.65

<?php

$username = '*******';
$db_password = '*******';
$database = '*******';

$IP = $_SERVER['REMOTE_ADDR'];

$CAMPAIGN = $_GET['MID'];

mysql_connect('localhost',$username,$db_password);
@mysql_select_db($database) or die( "Unable to select database");

mysql_query("INSERT INTO email_table VALUES ('$CAMPAIGN', '$IP',)") or die(mysql_error() );
mysql_close();
exit;
?>

I’m getting:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘)’ at line 1

Answer 1

You appear to have an extra comma at the end:

INSERT INTO email_table VALUES ('$CAMPAIGN', '$IP',)

Try:

INSERT INTO email_table VALUES ('$CAMPAIGN', '$IP')

BTW, I won’t judge your code too much but tracking people by IP is not very reliable. For example, a lot of corporate traffic behind company firewalls can use the same IP address.

Also, it looks like $CAMPAIGN comes from the HTTP post, which can be a security issue if you’re not parameterizing your SQL.