Getting Uncaught mysqli_sql_exception in my project

Question

I am learning how to make android app.

I already visited this links of stackoverflow How to deal with mysqli problems? mysqli_fetch_array(): Argument #1 must be of type mysqli_result but i didn't understand anything.

I am getting "Uncaught mysqli_sql_exception: You have an error in your SQL syntax;" error. since I am new to php and database I am not able to reslove the issue. I hope you guys will help me. I am providing everystuff to seek better help.

Mysql database: Database Image

The error: Error in postman

I am getting error in this part of code:

if($request->{'action'} == 'ADD_NEWS'){
        $isValidRequest = true;

        $headline = $request -> {'headline'};
        $description = $request -> {'description'};
        $userId = $request -> {'userId'};

        $query = "INSERT INTO news('headline','description','user_id') VALUES ('".$headline."','".$description."','".$userId."')";
        $result = mysqli_query($connection,$query);
        if($result){
            $response['newsId'] = mysqli_insert_id($connection);
            $response['status'] = true; 
            $response['responseCode'] = 0; //News Added Successfully
            $response['message'] = "News Added Successfully";               
        }else{
            $response['status'] = false; 
            $response['responseCode'] = 102; //News not added
            $response['message'] = "News Not Added";
        }

The line i am getting error in is: $result = mysqli_query($connection,$query);

The whole code:

<?php

include 'config/db_config.php';

$data = file_get_contents("php://input");
$request = json_decode($data);
$response = array();
$isValidRequest = false;

//{"action":"REGISTER_USER","userName":"Mr. Amir"}
//REGISTER_USER
//ADD_NEWS
//GET_NEWS
//UPDATE_NEWS
//DELETE_NEWS

if(isset($request->{'action'})){
    if($request->{'action'} == 'REGISTER_USER'){
        $isValidRequest = true;
        $userName = $request -> {'userName'};

        $query = "INSERT INTO user(name) values('".$userName."')";
        $result = mysqli_query($connection,$query);
        if($result){
            $response['userId'] = mysqli_insert_id($connection);
            $response['status'] = true; 
            $response['responseCode'] = 0; //User Registered Successfully
            $response['message'] = "User Registered Successfully";              
        }else{
            $response['status'] = false; 
            $response['responseCode'] = 102; //User Registered Failed
            $response['message'] = "User Registered Failed";                
        }
    }

    if($request->{'action'} == 'ADD_NEWS'){
        $isValidRequest = true;

        $headline = $request -> {'headline'};
        $description = $request -> {'description'};
        $userId = $request -> {'userId'};

        $query = "INSERT INTO news('headline','description','user_id') VALUES ('".$headline."','".$description."','".$userId."')";
        $result = mysqli_query($connection,$query);
        if($result){
            $response['newsId'] = mysqli_insert_id($connection);
            $response['status'] = true; 
            $response['responseCode'] = 0; //News Added Successfully
            $response['message'] = "News Added Successfully";               
        }else{
            $response['status'] = false; 
            $response['responseCode'] = 102; //News not added
            $response['message'] = "News Not Added";
        }
    }

    if($request->{'action'} == 'GET_NEWS'){
        $isValidRequest = true;
    }

    if($request->{'action'} == 'UPDATE_NEWS'){
        $isValidRequest = true;
    }

    if($request->{'action'} == 'DELETE_NEWS'){
        $isValidRequest = true;
    }

    if(!$isValidRequest){
        $response['status'] = false; 
        $response['responseCode'] = 100; //Invalid request action
        $response['message'] = "Invalid request action";
    }
}else{
    $response['status'] = false; 
    $response['responseCode'] = 100; //Request action not defined
    $response['message'] = "Request action not defined";
}

echo json_encode($response);

?>

**Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/32391315) — Dharman, Jun 01 '22 at 19:13
It looks like you are using some really bad tutorial. I highly encourage you to find something better. If you are only starting to learn PHP then you should learn PDO instead of mysqli. PDO is much easier and more suitable for beginners. Start here https://phpdelusions.net/pdo & https://websitebeaver.com/php-pdo-prepared-statements-to-prevent-sql-injection. Here are some good video tutorials https://youtu.be/2eebptXfEvw & https://www.youtube.com/watch?v=sVbEyFZKgqk&list=PLr3d3QYzkw2xabQRUpcZ_IBk9W50M9pe- — Dharman, Jun 01 '22 at 19:13

Getting Uncaught mysqli_sql_exception in my project

0 Answers0