Question

The following is throwing a syntax error. The entire query works in a MySQL client with literals, but breaks down when passing from PHP. In PHP, each query works if submitted separately, but not if within START and COMMIT.

The error:

1064: You have an error in your SQL syntax; check the manual ...etc...right
syntax to use near 'INSERT INTO user_degrees (user_id, degree_id, acadcat_id
, inst_id) VALUES (' at line 2

Query:

$query="START TRANSACTION;

INSERT INTO user_degrees (user_id, degree_id, acadcat_id, inst_id) 
VALUES ((SELECT id FROM users WHERE users.username = '$user')
   , '$degreeid', '$studyfocus', '$institution');

UPDATE users 
SET degree".$dnum." = (SELECT LAST_INSERT_ID())
WHERE username = '$user';

COMMIT;";

All the $vars are class properties and pass integers, except for $user, which passes a username session variable. $dnum is used to change column names between instances of the class and I might be concatenating it incorrectly within MySQL.

Answer 1

PHP’s mysql driver only allows a single query per mysql_query() call as a security measure. You’ll have to issue multiple separate queries:

$result = mysql_query("START TRANSACTION");
$result = mysql_query("INSERT ...");
$result = mysql_query("UPDATE ...");
$result = mysql_query("COMMIT;");

… with appropriate checking at each stage to make sure the query didn’t fail (which I’ve omitted from here).

Note that this security measure only applies to top-level queries. One one top-level query per call. You can have as many subqueries as you want/need.