You need to make sure you have added the column cash
to the users
table as described in the pset 7 specification:
Okay, let’s give each of your users some cash. Assuming you’re still
on phpMyAdmin’s Structure tab, you should see a form with which
you can add new columns. Click the radio button immediately to the
left of After, select hash from the drop-down menu, as in the
below, then click Go.

Via the form that appears, define a field called cash of type
DECIMAL
with a length of 65,4
, with a default value of 0.0000
,
and with an attribute of UNSIGNED
, as in the below, then click
Save.

You don't need quotes around placeholder values in a parameterized query. This is what Chris meant in the following comment (emphasis mine):
@Qiu The ?
is not a parameter. It is the string literal "?". This
query will insert a row in the users table with the "?" values for the
username, hash, and cash columns. So the correct form is to omit the
single quotations.
The point of using the ?
characters as placeholders in the query string and then supplying the values as arguments to query()
is that the function will format the statement as appropriate for whatever values you supply.
You can improve this code:
if (query("INSERT INTO users (username, hash, cash) VALUES('?', '?', '10000.00')", $_POST["username"], crypt($_POST["password"])) !== false)
{
// if statement body
}
In a few ways. First, break it up into several lines. You're doing several things here, and when you get an error message that tells you what line is at fault, one big line means more work to figure out which part is broken.
Second, as long as you're using a parameterized query, it makes sense to insert all the values as parameters, not just some of them. Although you can save some lines of code by hard-coding the value 10000.00
, your priority while learning should be making your code as readable and understandable as possible; not as brief as possible.
Here's how I would suggest rewriting that line:
$stmt = "INSERT INTO users (username, hash, cash) VALUES (?, ?, ?)";
$starting_cash = 10000.00;
$result = query($stmt, $_POST["username"], crypt($_POST["password"]), $starting_cash);
if ($result !== false)
{
// if statement body
}
This way you can see at a glance what the query is that's going to be executed for this section, without having to even think about the values. You can see the reason that 10000.00
is being inserted, because it's named $starting_cash
. And you can see exactly what's being tested -- the result of the query. Much more readable, much more understandable, probably easier to debug.
To fix the syntax error, make sure you don't have any extra or missing quotation marks, commas or parentheses in your query. Declaring the query statement in a separate variable can help here, too.
?
is not a parameter. It is the string literal "?". This query will insert a row in the users table with the "?" values for the username, hash, and cash columns. So the correct form is to omit the single quotations. As for the cash column, are you trying to add it in phpMyAdmin? If so, what is the error message you receive while doing so??>
should be omitted if it is the last thing in the php file: stackoverflow.com/questions/3219383/…. Also, please try to limit your code to the part that's causing the error, this means people can't copy your code, and per academic misconduct. When inserting a new user in your if statement, you've put an extra comma in the values section just after a?
. It's hard to tell what else is wrong. Open phpmyadmin and test the sql statements you've wrote in the sql section but replace the?
with hard coded values to test the syntax.