----- Original Message -----
From: Jason Pruim <japruim@raoset.com>
To: TG <tg-php@gryffyndevelopment.com>
Cc: "PHP General List" <php-general@lists.php.net>
Date: Fri, 14 Mar 2008 14:56:32 -0400
Subject: Re: [php] Is this the best way?

>
> On Mar 14, 2008, at 1:44 PM, TG wrote:
>
> >
> > What error are you getting? Maybe there's some way to fix that too.
>
> The error I get without checking the row count is this:
>
> You have an error in your SQL syntax; check the manual that
> corresponds to your MySQL server version for the right syntax to use
> near 'order by LName' at line 1

Ok so the next thing to check is your query. Maybe echo it out so you can
see what's actually attempting to execute.

I don't see an "ORDER BY" in the SQL listed below.

Usually when I get errors like this, it's because a variable I expect to be
populated isn't and it messes up the SQL by leaving a blank where it
expects something.

SELECT * FROM users WHERE username = 'tg' ORDER BY LName

If I had:

$user = "'tg'"

with the single-quotes inside the variable.. if I typo'd on $user and did
something like:

$query = "SELECT * FROM users WHERE username = $usr ORDER BY LName";

Then I'd get:

SELECT * FROM users WHERE username = ORDER BY LName



> >
> >
> > Just remember that errors and notices are like pain. It usually means
> > there's something wrong. If you're getting an error, there may be a
> > better
> > way of doing waht you're doing.
> >
> > Ideally, you should get zero results if there's no match in the user
> > database.
> >
> > Typically for a user lookup, you might do something like this:
> >
> > SELECT <whatever> FROM usertable WHERE username = '<username>' AND
> > password =
> > '<password>'
>
> Which is very simular to what I have:
>
> $loginQuery = "SELECT * FROM current WHERE loginName='".$user."' AND
> loginPassword='".$password."' LIMIT 0,1;";
> $loginResult = mysqli_query($link1, $loginQuery) or die("Wrong data
> supplied or database error" .mysqli_error($link1));