-1

I am new to php. I am trying to connect android with phpmyadmin using webservice .

php Code

<?php
    include_once('configuration.php');


$UserId = $_POST['UserId'];
$ProductId = $_POST['ProductId'];
$DesiredQuantity = $_POST['DesiredQuantity'];
$cartstable=mysql_query("SELECT `UserId`, `ProductId`, `DesiredQuantity` FROM `carts` WHERE UId='".$UserId. "' AND ProductId='".$ProductId. "'");

    $num_rows = mysql_num_rows($cartstable);
        if($num_rows>0){
 $updateqry=mysql_query("Update `carts` set `DesiredQuantity`= `DesiredQuantity` + $DesiredQuantity) WHERE UId='".$UserId. "' AND ProductId='".$ProductId. "');

}
       else
{
$insertqry=mysql_query ("Insert into `carts` (`UId`, `ProductId`, `DesiredQuantity`) VALUES ('".$UserId. "','".$ProductId. "',$DesiredQuantity)");

}


        $carts_ful=mysql_query("SELECT `UserId`, `ProductId`, `DesiredQuantity` FROM `CARTS` WHERE UId='".$UserId. "'");

       while($carts = mysql_fetch_array($carts_ful)){
        extract($carts);
        $result[] = array("UserId" => $UserId,"ProductId" => $ProductId,"DesiredQuantity" => $DesiredQuantity); 
    }
        $json = array("Updated Cart Details" => $result);
       @mysql_close($conn); 
        header('Content-type: application/json');
       // echo "Selected Product is added to the Cart !";
        echo json_encode($json);


 ?>

When I tried running,I see the following error

<b>Parse error</b>:  syntax error, unexpected 'insert' .

If I Cut and paste,

 $insertqry=mysql_query ("Insert into `carts` (`UId`, `ProductId`, `DesiredQuantity`) VALUES ('".$UserId. "','".$ProductId. "',$DesiredQuantity)");

line above the if statement ,It works fine.

I could not understand where is the problem .Please help me finding the solution .

4
  • You don't close the string at the end of the $updateqry=mysql_query line. Commented May 24, 2015 at 22:53
  • Use a proper editor/IDE. The syntax highlighting would have indicated the error, just as SO is doing. (I hate to think which editor people who ask these questions use..) Commented May 24, 2015 at 22:54
  • Thanks a lot :-) Now works fine @ Jon Stirling Commented May 24, 2015 at 23:15
  • 1
    Also, you have serious SQL injection vulnerabilities in this code. The UPDATE statement can be misused by a malicious user to set any column in any/all rows as they wish. Use parameter binding to avoid this. Commented May 25, 2015 at 0:07

1 Answer 1

1

Stack Overflow's syntax highlighting should have been enough to spot the error.

You have missed a closing quote from one of your SQL queries. Find the amendment below.

 $updateqry=mysql_query("Update `carts` set `DesiredQuantity`= `DesiredQuantity` + $DesiredQuantity) WHERE UId='".$UserId. "' AND ProductId='".$ProductId."'");

}
       else
{
$insertqry=mysql_query ("Insert into `carts` (`UId`, `ProductId`, `DesiredQuantity`) VALUES ('".$UserId. "','".$ProductId. "',$DesiredQuantity)");

}
Sign up to request clarification or add additional context in comments.

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.