Inserting data into database

Question

I use this code added into success.phtml when ever I run this code the webpage crashes. The success page just never loads and stays white. I'm sure its a simple mistake that I am making but I haven't been able to figure it out yet. So I figured i'd give it a shot on here.

This code is near the beginning of the file and works fine

$grayson_order_id = $this->getOrderId();
$order2 = Mage::getModel('sales/order')->loadByIncrementId($grayson_order_id);
$custname = $order2->getBillingAddress()->getName();

This code however does not work.

<?php
echo "a";
$lastOrderId = Mage::getSingleton('checkout/session')->getLastOrderId();
echo "b";
echo "<br />";
$order = Mage::getSingleton('sales/order'); 
echo "c";
echo "<br />";
$order->load($lastOrderId);
echo "c";
echo "<br />";
$totalAmount = $order->getData('base_grand_total');
echo "d";
echo "<br />";
echo "total amount ". $totalAmount;
echo "<br />";
$sellerId = Mage::getModel('core/cookie')->get('smashingmagazine_affiliate_source');
echo "e";
echo "<br />";
echo "aff id ". $sellerId;
echo "<br />";
$w = Mage::getSingleton('core/resource')->getConnection('core_write');
echo "f";
echo "<br />";
$result = $w->query('INSERT INTO grayson_custom (refer, time, amount, name, order_id) VALUES ('$sellerId', 'date('Y-m-d H:i:s')','$totalAmount','$custname','$this->getOrderId()')');
echo "g";
echo "<br />";

?>

I don't think it matters much but I am using Magento Enterprise Edition 1.13

Thanks for all your help!

Answer 1

Error is on this line:

$result = $w->query('INSERT INTO grayson_custom (refer, time, amount, name, order_id) VALUES ('$sellerId', 'date('Y-m-d H:i:s')','$totalAmount','$custname','$this->getOrderId()')');

Can be fixed by changing to:

$result = $w->query('INSERT INTO grayson_custom (refer, time, amount, name, order_id) VALUES ('.$sellerId.', '.date('Y-m-d H:i:s').','.$totalAmount.','.$custname.','.$this->getOrderId().')');

What ever you are trying to do STOP, this is not how you should be developing on Magento, this sort of action should be handled with a custom module and a making use of Magento Observer Event triggers, checkout_onepage_controller_success_action if possible.

Also I think you might have a SQL injection on the above line, because you get the Cookie smashingmagazine_affiliate_source, if the user maliciously malforms the cookie it could potentially cause a security breach!

http://magentotherightway.com/ | http://www.phptherightway.com/ | Hire a developer