I am new to php. I am trying to connect android with phpmyadmin using webservice .
php Code
<?php
include_once('configuration.php');
$UserId = $_POST['UserId'];
$ProductId = $_POST['ProductId'];
$DesiredQuantity = $_POST['DesiredQuantity'];
$cartstable=mysql_query("SELECT `UserId`, `ProductId`, `DesiredQuantity` FROM `carts` WHERE UId='".$UserId. "' AND ProductId='".$ProductId. "'");
$num_rows = mysql_num_rows($cartstable);
if($num_rows>0){
$updateqry=mysql_query("Update `carts` set `DesiredQuantity`= `DesiredQuantity` + $DesiredQuantity) WHERE UId='".$UserId. "' AND ProductId='".$ProductId. "');
}
else
{
$insertqry=mysql_query ("Insert into `carts` (`UId`, `ProductId`, `DesiredQuantity`) VALUES ('".$UserId. "','".$ProductId. "',$DesiredQuantity)");
}
$carts_ful=mysql_query("SELECT `UserId`, `ProductId`, `DesiredQuantity` FROM `CARTS` WHERE UId='".$UserId. "'");
while($carts = mysql_fetch_array($carts_ful)){
extract($carts);
$result[] = array("UserId" => $UserId,"ProductId" => $ProductId,"DesiredQuantity" => $DesiredQuantity);
}
$json = array("Updated Cart Details" => $result);
@mysql_close($conn);
header('Content-type: application/json');
// echo "Selected Product is added to the Cart !";
echo json_encode($json);
?>
When I tried running,I see the following error
<b>Parse error</b>: syntax error, unexpected 'insert' .
If I Cut and paste,
$insertqry=mysql_query ("Insert into `carts` (`UId`, `ProductId`, `DesiredQuantity`) VALUES ('".$UserId. "','".$ProductId. "',$DesiredQuantity)");
line above the if statement ,It works fine.
I could not understand where is the problem .Please help me finding the solution .
$updateqry=mysql_queryline.UPDATEstatement can be misused by a malicious user to set any column in any/all rows as they wish. Use parameter binding to avoid this.