Help With This Query?

Author: admin  //  Category: SQl Injection

I have the following query for mysql but it keeps giving me an error and I am not sure why
“SELECT pd.products_name, pd.products_description, pd.products_url, p.products_quantity, p.price,p.products_weight,p.products_mod… from products_description pd, products d, where p.products=
‘{$_GET['id']}’
and pd.products_id=
‘p.products_id’ ”
I realize that I am not gaurding against the SQL injection I was plugging value in for testing.
the problem is in the where statement
1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘where p.products=’8574′ and pd.products_id=’p.products_id” at line 1
Can someone help please?

Tags: , , ,

3 Responses to “Help With This Query?”

  1. Jeff Alexander Says:

    The problem is in the from clause:
    “from products_description pd, products d,”
    Remove the comma after “products d,”
    With the comma, the parser expects another table name whereas this query begins the “where” clause.

  2. Colanth Says:

    1) Unless the ID of the product is literally “p.products_id”, take it put of the single quotes. (pd.products_id, a numeric, and ‘p.products_id’, a char field, are most likely never equal.)
    2) Is p.products a char field or a numeric field? If numeric, take 8574 out of single quotes. (And, when you substitute your variable, keep it out of single quotes too - it’s the type of field that determines whether the value - literal or variable - gets quoted.)

  3. emb3rx Says:

    If this is being run in PHP, remember that you have to ‘terminate’ the literal string and then concatenate the variables, like so:
    ‘literal val ‘ .variable. ‘ more literal’
    It looks like you’re trying to get PHP variables into the SQL query at Runtime, like {$_GET['id']} for instance.
    Another thing to look at, you’re declaring at the end there that you want pd.products_id to equal the literal string ‘p.products_id’
    All of this answer is inherently void if there’s something about MySQL that I don’t understand, though it would have to be fundamentally different from most other versions of SQL in order to actually process queries in such a different way.

Leave a Reply