Question

I’m using a modified version of a pre-written script. It works in other places on the site but I can’t work out what I’ve missed here…

    $insertQuery = "INSERT INTO cmsportfolio (status,title,imgurl,imgthumb,section,url,`desc`,type) VALUES (".
    "'".$HTTP_POST_VARS['status']."', ".
     "'".$HTTP_POST_VARS['title']."', ".
    "'".addslashes($HTTP_POST_VARS['imgurl'])."', ".
    "'".addslashes($HTTP_POST_VARS['imgthumb'])."', ".
    "'".$HTTP_POST_VARS['section'].", ".
    "'".addslashes($HTTP_POST_VARS['url'])."', ".
    "'".addslashes($HTTP_POST_VARS['desc'])."', ".
    "'".$HTTP_POST_VARS['type']."' )";


if ($result = $connector->query($insertQuery)){

    header('Location: ' . $_SERVER['PHP_SELF'].'?action=addsuccess');
    exit;

}else{
    echo "Error message = ".mysql_error(); 
    exit('<center>Sorry, there was an error saving to the database</center>');
}

I get the error message:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘http://www.xxxxxxxx.co.uk‘, ‘frgdr tr tr’, ‘0’ )’ at line 1
Sorry, there was an error saving to the database

(the error refers to the last 3 fields of the query)

Answer 1

 "'".$HTTP_POST_VARS['section'].", ".

Missing ending quote