Gebruik van " en ' zorgt voor error
Error! :
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'tekst waar het om gaat ' at line 1
De code van een cms pagina waar het bij foutgaat is de volgende, ik hoop dat jullie hier kunnen zien wat de foutmelding veroorzaakt.
<code>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<title>site</title>
<link rel="stylesheet" type="text/css" href="style/style.css">
<style type="text/css">
<!--
.style1 {
font-size: 11px;
font-weight: bold;
}
-->
</style>
<style>
body
{
font-family: verdana;
font-size:12px;
margin-left:20px;
}
table
{
font-family: verdana;
font-size:12px;
border-collapse:collapse;
border:1px solid #000000;
}
</style>
</head>
<body>
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
<?php
include_once("_sys/adminclass.php");
include_once("_sys/mysqlclass.php");
$test = new AdminClass("xxx","xxx","xxx","xxx","xxx");
$main_niet = array("datum");
//$test->showTabel();
echo "<br/><br/>";
echo "<a href='index.php'>Terug</a> | ";
$test->addLink("add");
echo " | ";
$test->addLink("overzicht");
echo "<br/><br/>";
if(isset($_GET["action"]))
{
if($_GET["action"] == "add")
{
if(isset($_GET["voegtoe"]))
{
foreach($_POST as $key => $value)
{
//echo "$key -> $value<br/>";
}
$insert = new mysqlMan($test->host,$test->user,$test->pass,$test->db);
$insert->addRecord($test->db_tabel,$_POST);
echo "Record toegevoegd. <a href='".$_SERVER['PHP_SELF']."'>Terug</a>";
echo "<script>window.location='".$_SERVER['PHP_SELF']."'</script>";
}
else
{
$niet = $main_niet;
$test->showAddVelden();
}
}
elseif($_GET["action"] == "edit" && isset($_GET["id"]))
{
if(!empty($_GET["id"]) && is_numeric($_GET["id"]))
{
if(isset($_GET["pasaan"]))
{
foreach($_POST as $key => $value)
{
//echo "$key -> $value<br/>";
}
$insert = new mysqlMan($test->host,$test->user,$test->pass,$test->db);
$insert->editRecord($test->db_tabel,$_POST,$test->idveld."='" . $_GET["id"] . "'");
echo "Record aangepast. <a href='".$_SERVER['PHP_SELF']."'>Terug</a>";
echo "<script>window.location='".$_SERVER['PHP_SELF']."'</script>";
}
else
{
$niet = $main_niet;
$test->showEditVelden($_GET["id"],$niet);
}
}
}
elseif($_GET["action"] == "delete" && isset($_GET["id"]))
{
if(isset($_GET["verwijder"]))
{
$insert = new mysqlMan($test->host,$test->user,$test->pass,$test->db);
$insert->delRecord($test->db_tabel,$test->idveld."='" . $_GET["id"] . "'");
echo "Record verwijderd. <a href='".$_SERVER['PHP_SELF']."'>Terug</a>";
echo "<script>window.location='".$_SERVER['PHP_SELF']."'</script>";
}
else
{
$test->showDelMsg($_GET["id"]);
}
}
}
else
{
$niet = $main_niet;
$test->showRecords(1,1,$niet);
}
}
else
{
echo "U bent niet ingelogd";
}
?>
include_once("_sys/adminclass.php");
include_once("_sys/mysqlclass.php");
$test = new AdminClass("xxx","xxx","xxx","xxx","xxx");
$main_niet = array("datum");
//$test->showTabel();
echo "<br/><br/>";
echo "<a href='index.php'>Terug</a> | ";
$test->addLink("add");
echo " | ";
$test->addLink("overzicht");
echo "<br/><br/>";
if(isset($_GET["action"]))
{
if($_GET["action"] == "add")
{
if(isset($_GET["voegtoe"]))
{
foreach($_POST as $key => $value)
{
//echo "$key -> $value<br/>";
}
$insert = new mysqlMan($test->host,$test->user,$test->pass,$test->db);
$insert->addRecord($test->db_tabel,$_POST);
echo "Record toegevoegd. <a href='".$_SERVER['PHP_SELF']."'>Terug</a>";
echo "<script>window.location='".$_SERVER['PHP_SELF']."'</script>";
}
else
{
$niet = $main_niet;
$test->showAddVelden();
}
}
elseif($_GET["action"] == "edit" && isset($_GET["id"]))
{
if(!empty($_GET["id"]) && is_numeric($_GET["id"]))
{
if(isset($_GET["pasaan"]))
{
foreach($_POST as $key => $value)
{
//echo "$key -> $value<br/>";
}
$insert = new mysqlMan($test->host,$test->user,$test->pass,$test->db);
$insert->editRecord($test->db_tabel,$_POST,$test->idveld."='" . $_GET["id"] . "'");
echo "Record aangepast. <a href='".$_SERVER['PHP_SELF']."'>Terug</a>";
echo "<script>window.location='".$_SERVER['PHP_SELF']."'</script>";
}
else
{
$niet = $main_niet;
$test->showEditVelden($_GET["id"],$niet);
}
}
}
elseif($_GET["action"] == "delete" && isset($_GET["id"]))
{
if(isset($_GET["verwijder"]))
{
$insert = new mysqlMan($test->host,$test->user,$test->pass,$test->db);
$insert->delRecord($test->db_tabel,$test->idveld."='" . $_GET["id"] . "'");
echo "Record verwijderd. <a href='".$_SERVER['PHP_SELF']."'>Terug</a>";
echo "<script>window.location='".$_SERVER['PHP_SELF']."'</script>";
}
else
{
$test->showDelMsg($_GET["id"]);
}
}
}
else
{
$niet = $main_niet;
$test->showRecords(1,1,$niet);
}
}
else
{
echo "U bent niet ingelogd";
}
?>
</form>
</body>
</html>
</code>
Gewijzigd op 01/01/1970 01:00:00 door Robert-Jan De Vries
Beveiliging ontbreekt waarschijnlijk. Zie mysql_real_escape_string().
Is er een snelle manier om dat aan te passen?
Dat zit waarschijnlijk ergens in je classe.
htmlentities wel. Maar dan moet je wel op je output ff html_entity_decode zetten ;)
Misschien werkt Of zit het niet specifiek in dit script?