Inserting data into MySQL database

Question

I'm struggling with inserting data from the form to database. I managed to establish the connection (at least not getting any errors), but when comes to inserting values I facing error, I'm not sure if rows/columns of the table should be in ' ' or not, I've seen some examples both with quotation marks and without, and also if variables should have those as well.

connecting to the database (connect.php):

<?php
define("DB_SERVER","localhost");
define("DB_USER","root");
define("DB_PASS","");
define("DB_NAME","Bookshop");

$connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS);
    if(!$connection){
        die("error: unable to connect to database " . mysql_error());
    }
    $select_db = mysql_select_db(DB_NAME, $connection);
    if(!$select_db){
        die("error: unable to connect to database " . mysql_error());
    }
?>   

including connections:

<?php
    include ("connect.php"); // connects to database
?>

and inserting data from the form:

$query = "INSERT INTO customer 
                (CUST_ID, CUST_NAME, CUST_SURNAME, HOUSE_NO, STREET, POSTCODE, PHONE_NO, EMAIL, OGIN, PASSWORD)
                VALUES 
                ('10101', '$forename', '$surname', '$address1', '$address2', '$postcode', 
                '$phone_no', '$email', '$login', '$password')"; 
mysql_query($query, $connection);

    if(!mysql_query($query, $connection)){
        echo "Error!!!!";
    }

mysql_close($connection);   

Answer 1

It seems you are a newbie.. Start with mysqli or pdo extensions. Visit W3schools.com for a detailed explanantion with examples. Below is an example of how to use mysqli to connect and insert a row in your database

 <?php
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "myDB";

// Create connection
$conn = mysqli_connect($servername, $username, $password, $dbname);
// Check connection
if (!$conn) {
    die("Connection failed: " . mysqli_connect_error());
}

$sql = "INSERT INTO MyGuests (firstname, lastname, email)
VALUES ('John', 'Doe', 'john@example.com')";

if (mysqli_query($conn, $sql)) {
    echo "New record created successfully";
} else {
    echo "Error: " . $sql . "<br>" . mysqli_error($conn);
}

mysqli_close($conn);
?>

And For your query..

I'm not sure if rows/columns of the table should be in ' ' or not, I've seen some examples both with quotation marks and without, and also if variables should have those as well.

As far as insert queries are concerned, 1).Wrap up column names with ` back ticks. 2).Wrap your Variables with single quote nothing wrong in that

For more understanding about single and double quote usages,

Single quotes does not look for variables while double quote does

Case 1 :

    $value = 10;
    $sql = 'SELECT * FROM `table_name` WHERE `column_name` = $value';
    echo $sql;

output is

SELECT * FROM `table_name` WHERE `column_name` = $value

Here if you see single quote does not look for a variable within it. Whatever there is inside single quotes, it is considered as a string and returned as such.

Case 2:

    $value = 10;
    $sql = "SELECT * FROM `table_name` WHERE `column_name` = $value";
    echo $sql;

Output is

 SELECT * FROM `table_name` WHERE `column_name` = 10

Here Since the query is inside double quotes, That variable is read. but considered as int.

Case 3:

    $value = 10;
    $sql = "SELECT * FROM `table_name` WHERE `column_name` = '$value'";
    echo $sql; 

Output is

SELECT * FROM `table_name` WHERE `column_name` = '10'

Here Since the query is inside double quotes, That variable is read. but considered as string as it is encapsulated with single quotes.