Error in SQL syntax

[James]

Hi, I seem to be having a problem inserting data into a database

// check to make sure fields are entered
 if ($name == '' ||  $address1== '' || $address2 == '' || $town == '' || $county == '' || $postcode == '' || $info == '' || $price == '')
 {
 // generate error message
 $error = 'ERROR: Please fill in all required fields!';
 
 // if either field is blank, display the form again
 renderForm($name, $address1, $address2, $address1, $town, $county, $postcode, $info, $price, $error);
 }
 else
 {
 // save the data to the database
 mysql_query("INSERT houses SET name='$name', address1='$address1',
 address2='$address2', town='$town', county='$county', postcode='$postcode', info='$info', price='$price' WHERE id='$id'")
 or die(mysql_error()); 
 
 // once saved, redirect back to the view page
 header("Location: admin.php"); 
 }
 }
 else
 // if the form hasn't been submitted, display the form
 {
 renderForm('','','','','','','','','');
 }
?> 
 
 

The error i'm getting is

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE id=''' at line 2

[johny10151981]

1. Read Insert Query structure again(If you read before) from the documentation.
2. read about sql injection from wiki
3. read about mysq_real_escape_string from php.net

[Artnessde]

As from what i see in your code (which is not escaping anything - may the good SQL Injections be with you) your $id variable is simply empty.

That's what the SQL Error tells you.

ALWAYS sanitize ANY Userinput and verifyt the where clause has valid and filled variables (as in any other usecase where you handle external user-input which is always possibly filtrated with potential exploit code)