All i want to know is it injection or only sql error   SELECT * FROM users_address WHERE user_id =  You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'order by 1 LIMIT 0, 25' at line 3
73
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
30879
I'm trying to use a select statement to get all of the columns from a certain MySQL table except one. Is there a simple way to do this?  EDIT: There are 53 columns in this table (NOT MY DESIGN)
25709
Let's say I have code like this:  $dbh = new PDO("blahblah");  $stmt = $dbh-&gt;prepare('SELECT * FROM users where username = :username'); $stmt-&gt;execute( array(':username' =&gt; $_REQUEST['username']) );   The PDO documentation says:     The parameters to prepared statements don't need to be quoted; the driver handles it for you.   Is that truly all I need to do to avoid SQL injections?  Is it really that easy?  You can assume MySQL if it makes a difference.  Also, I'm really only curious about the use of prepared statements against SQL injection.  In this context, I don't care about XSS or other possible vulnerabilities.
106704
Which is the valid syntax of this query in MySQL?  SELECT * FROM courses WHERE (now() + 2 hours) &gt; start_time   note: start_time is a field of courses table
22248
I have Drupal running on MariaDB 5.5.33. When I run update.php (after upgrade to Drupal 7.28 from Drupal 6) I get an error:     Failed: PDOException: SQLSTATE[42S02]: Base table or view not found: 1146 Table 'webdb.location_country' doesn't exist: CREATE TABLE {location_country} ( code CHAR(2) NOT NULL COMMENT 'Primary Key: Two letter ISO Country Code', name VARCHAR(255) NOT NULL DEFAULT '' COMMENT 'Full Country Name ', PRIMARY KEY (code) ) ENGINE = InnoDB DEFAULT CHARACTER SET utf8 COMMENT 'Country data managed by location.module.'; Array ( ) indb_create_table() (line 2720 of /home/web/public_html/includes/database/database.inc).   When I try to run command     CREATE TABLE {location_country} ( code CHAR(2) NOT NULL COMMENT 'Primary Key: Two letter ISO Country Code', name VARCHAR(255) NOT NULL DEFAULT '' COMMENT 'Full Country Name ', PRIMARY KEY (code) ) ENGINE = InnoDB DEFAULT CHARACTER SET utf8 COMMENT 'Country data managed by location.module.';   in phpMyAdmin I get an error     #1064 - You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '{location_country} ( code CHAR(2) NOT NULL COMMENT 'Primary Key: Two letter IS' at line 1   But I wasn't able to find out where is the problem.
90199
Im trying to setup replication between mariadb(10.1.31-MariaDB - MASTER) and mysql(5.7.12-log - SLAVE). After executed the start slave, I got the below error.     Fatal error: The slave I/O thread stops because a fatal error is   encountered when it tries to get the value of SERVER_UUID variable   from master.   Then I tried to get the value of master_uuid.  MariaDB [(none)]&gt; show variables like '%server_uuid%'; Empty set (0.00 sec)   Then tried to setup this in mysql prompt.  MariaDB [(none)]&gt; set global  server_uuid = 11123c25-cac0-3523-8089-4c54d9b46f33; ERROR 1193 (HY000): Unknown system variable 'server_uuid'   And also I tried to setup auto.cnf in data directory.  [auto] server_uuid = 11123c25-cac0-3523-8089-4c54d9b46f33  chmod 644 auto.cnf   But still im getting the fatal error is encountered when it tries to get the value of SERVER_UUID variable from master.
14497
I have an SQL select, that gives two rows back. The SQL update gives the error message 1093 back;     mysqli error: [1093: Table 'HD_TICKET' is specified twice, both as a   target for 'UPDATE' and as a separate source for data]   update HD_TICKET, HD_STATUS as T5     set HD_TICKET.HD_STATUS_ID = T5.ID,  HD_TICKET.TIME_OPENED  = IF(T5.STATE = 'opened', NOW(), HD_TICKET.TIME_OPENED),  HD_TICKET.TIME_CLOSED  = IF(T5.STATE = 'closed', NOW(), HD_TICKET.TIME_CLOSED),  HD_TICKET.TIME_STALLED = IF(T5.STATE = 'stalled', NOW(), HD_TICKET.TIME_STALLED),  HD_TICKET.SATISFACTION_RATING = IF(T5.STATE = 'closed', NULL, HD_TICKET.SATISFACTION_RATING),  HD_TICKET.SATISFACTION_COMMENT = IF(T5.STATE = 'closed', NULL, HD_TICKET.SATISFACTION_COMMENT),  HD_TICKET.TITLE = (SELECT NAME FROM ORG1.ASSET WHERE ORG1.ASSET.ID = (SELECT ASSET_ID FROM HD_TICKET WHERE HD_TICKET.ID = HD_TICKET.PARENT_ID))   where T5.NAME = 'New' and  HD_TICKET.HD_QUEUE_ID = T5.HD_QUEUE_ID and     (HD_TICKET.ID in (&lt;TICKET_IDS&gt;))   Can anybody help me, please? Thanks!
101410
I recently installed MySQL 5 on Windows 2003 and tried configuring an instance. Everything worked fine until I got to "Applying Security settings", at which point it gave me the above error (Can't connect to MySQL server on 'localhost' (10061)).  I do have a port 3306 exception in my firewall for 'MySQL Server'.
15587
I have a query to insert a row into a table, which has a field called ID, which is populated using an AUTO_INCREMENT on the column. I need to get this value for the next bit of functionality, but when I run the following, it always returns 0 even though the actual value is not 0:  MySqlCommand comm = connect.CreateCommand(); comm.CommandText = insertInvoice; comm.CommandText += "\'" + invoiceDate.ToString("yyyy:MM:dd hh:mm:ss") + "\', " + bookFee + ", " + adminFee + ", " + totalFee + ", " + customerID +  ")"; int id = Convert.ToInt32(comm.ExecuteScalar());   According to my understanding, this should return the ID column, but it just returns 0 every time. Any ideas?  EDIT:  When I run:  "INSERT INTO INVOICE (INVOICE_DATE, BOOK_FEE, ADMIN_FEE, TOTAL_FEE, CUSTOMER_ID) VALUES ('2009:01:01 10:21:12', 50, 7, 57, 2134);last_insert_id();"   I get:  {"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'last_insert_id()' at line 1"}
60461
What is a fast way to select a random row from a large mysql table?  I'm working in php, but I'm interested in any solution even if it's in another language.
21568
$sql = "SELECT Kill FROM tbl_pvporderview";   Problem is that I end up with: Incorrect syntax near the keyword 'Kill'.  Because kill is a T-SQL command... any way to bypass it?  I can't change the column name because it's used by the software a lot and I cant change the software that's using the database.  So it simply fails if I use sqlserv to select data from that column. '' or "" wont help.  The complete statement would be:  $sql = "SELECT serial,Kill FROM tbl_pvporderview WHERE Kill &gt; (?) ORDER BY Kill DESC ";
82615
On PHP 5.3.13/MySQL 5.5.21 the following code doesn't work:  if($check_custom_fields_form!=1){     $sql = "CREATE TABLE IF NOT EXISTS ". $table_custom_fields_form ." (                 `form_name` longtext NOT NULL,                 `field_id` bigint(20) NOT NULL,                 FOREIGN KEY (`field_id`) REFERENCES $table_custom_fields (`ID`) ON DELETE CASCADE ON UPDATE CASCADE     ) CHARACTER SET utf8 COLLATE utf8_general_ci";     dbDelta($sql); } if($check_subscribe_cat!=1){     $sql = "CREATE TABLE IF NOT EXISTS ". $table_subscribe_cat ." (                 `subscribe_id` bigint(20) NOT NULL,                 `cat_id` bigint(20) NOT NULL,                 FOREIGN KEY (`subscribe_id`) REFERENCES ".$wpdb-&gt;prefix."tgt_subscription (`ID`) ON DELETE CASCADE ON UPDATE CASCADE,                 FOREIGN KEY (`cat_id`) REFERENCES ".$wpdb-&gt;prefix."terms (`term_id`) ON DELETE CASCADE ON UPDATE CASCADE     ) CHARACTER SET utf8 COLLATE utf8_general_ci";     dbDelta($sql);  }   The  suggested a downgrade to MySQL 5.1.37 (no, thanks) or the following update:  if($check_custom_fields_form!=1){         $sql = "CREATE TABLE IF NOT EXISTS ". $table_custom_fields_form ." (                     `form_name` longtext NOT NULL,                     `field_id` bigint(20) NOT NULL,                     KEY(field_id)         ) CHARACTER SET utf8 COLLATE utf8_general_ci";         dbDelta($sql);     } if($check_subscribe_cat!=1){       $sql = "CREATE TABLE IF NOT EXISTS ". $table_subscribe_cat ." (                   `subscribe_id` bigint(20) NOT NULL,                   `cat_id` bigint(20) NOT NULL,                   KEY(subscribe_id),                   KEY(cat_id)       ) CHARACTER SET utf8 COLLATE utf8_general_ci";       dbDelta($sql);    }   Which seems like a rather dirty way to work around the problem (no cascading deletes/updates). Therefore:   Do I really have to live with that ? Is it true that dbDelta only works with foreign key in a 3 year old MySQL version?
54906
I want to select my particular database in mysql console, but the problem is that my database name has a space in between and mysql ignores the part after the space. For instance, when i give the command:  use 'student registration'   I get the message:  cannot find database 'student'
89686
trigger quotepotential on Quote_Line_Item__c (after insert) {     list&lt;batch__c&gt; b=[select batch_value__c                        from batch__c                        order by batch_value__c DESC LIMIT 1];     if(!b.isempty()){         list&lt;Quote_Line_Item__c&gt; quotelineitem=new list&lt;Quote_Line_Item__c&gt;();         for(Quote_Line_Item__c quoteline:trigger.new){             quoteline.max_batch__c=b.batch_value__c;             quotelineitem.add(quoteline);         }     } }   Help me to find out get rid of this error
86789
I don't have this kind of ID in my table, still MySQL is giving me a result.  This same result is giving when i place in my php code.
45100
I have a simple mysql table which I use as a server booking system. A user can log in to a server, if he has a valid booking for that server. A sample data might look like this:  +----------+----------------+---------------------+---------------------+ | server   | user           | start               | end                 | +----------+----------------+---------------------+---------------------+ | server01 | Alice,Bob      | 2013-10-28 00:00:00 | 2013-12-31 00:00:00 | | server02 | Carlos         | 2013-10-28 00:00:00 | 2013-12-31 00:00:00 | | server03 | Dan,Erin,Frank | 2013-10-28 00:00:00 | 2013-12-31 00:00:00 | +----------+----------------+---------------------+---------------------+   To check whether user Carlos has a booking for server02, I use the following SQL query:  SELECT 0, id FROM booking WHERE user = 'Carlos' AND (( start &lt; now() and end &gt; now() ) AND server = 'server02') ;   But this query does not work if there are multiple (comma-separated) users. How can I check if Alice has booking for server01 ?
53567
I have a query which is meant to show me any rows in table A which have not been updated recently enough. (Each row should be updated within 2 months after "month_no".):  SELECT A.identifier      , A.name      , TO_NUMBER(DECODE( A.month_no              , 1, 200803               , 2, 200804               , 3, 200805               , 4, 200806               , 5, 200807               , 6, 200808               , 7, 200809               , 8, 200810               , 9, 200811               , 10, 200812               , 11, 200701               , 12, 200702              , NULL)) as MONTH_NO      , TO_NUMBER(TO_CHAR(B.last_update_date, 'YYYYMM')) as UPD_DATE   FROM table_a A      , table_b B  WHERE A.identifier = B.identifier    AND MONTH_NO &gt; UPD_DATE   The last line in the WHERE clause causes an "ORA-00904 Invalid Identifier" error. Needless to say, I don't want to repeat the entire DECODE function in my WHERE clause. Any thoughts? (Both fixes and workarounds accepted...)