CODEWITHSUNDEEP
phpmysql
Reg Ellis
Reg Ellis

Reputation: 13

mysql INSERT INTO query - ERROR with syntax

Can anyone help with advising what may be wrong with my insert into syntax please ? Working except i am receiving empty query message

    // values sent from form
    $first_name=$_POST['first_name'];
    $last_name=$_POST['last_name'];
    $email=$_POST['email'];
    $postcode=$_POST['postcode'];
    $gender=$_POST['gender'];
    $yob=$_POST['yob'];

    /*********** CONNECT TO THE DATABASE ******/
    //Step 1 CONNECT TO THE DATABASE
   $db=mysql_connect ("localhost", “db_username, “db_password);
   if (!$db) {
     die("Database connection failed miserably: " . mysql_error());
     }
     //Step2 SELECT THE DATABASE
     $db_select = mysql_select_db(“db_name,$db);
    if (!$db_select) {
    die("Database selection also failed miserably: " . mysql_error());
    }

    echo "Welcome $first_name!";
    echo " Success, connected to database but maybe not the table";

    // Insert data into database
    //##############################I THINK PROBLEM MUST BE HERE IN THIS    INSERT       STATEMENT STATEMENT###################################
    $sql="INSERT INTO newsletter-subscribers(first_name, last_name, email,    postcode, gender,    yob)VALUES('$first_name','$last_name','$email','$postcode','$gender','$yob')";
    if(mysql_query($sql)){
    echo "Records added successfully.";
    } else{
    echo "ERROR: Could not able to execute $sql. " . mysql_error($db);
    }
    $result=mysql_query($sql);

Upvotes: 0

Views: 3645

Answers (2)

Dan Lowe
Dan Lowe

Reputation: 56687

Your table name contains a dash, so you need to quote it. The backtick or back-quote character is used to quote symbol names in MySQL (such as the names of tables, columns, etc), so you would need something like this:

INSERT INTO `newsletter-subscribers` (first_name, ...

Upvotes: 2

Script47
Script47

Reputation: 14550

Your query,

$sql="INSERT INTO newsletter-subscribers(first_name, last_name, email,    postcode, gender,    yob)VALUES('$first_name','$last_name','$email','$postcode','$gender','$yob')";

Your new query,

$sql = "INSERT INTO `newsletter-subscribers` (first_name, last_name, email, postcode, gender, yob) VALUES ('$first_name','$last_name','$email','$postcode','$gender','$yob')";

So, what has changed?

  • Added ticks around your table name.
  • Removed spaces which you didn't need to make query clearer.

Without the backticks around your table name, MySQL is treating it as newsletter minus subscribers. Which is wrong, add the ticks to tell MySQL that it is a table name.

Edit 1

This might be a copy & paste error, I'm not sure, however...

Your db connect is incorrect too, you aren't assigning any values to it as your quotes are not closed and are smart quotes.

Your connect,

$db = mysql_connect ("localhost", “db_username, “db_password);

Your new connect,

$db = mysql_connect("localhost", "db_username"," db_password");

Also,

$db_select = mysql_select_db(“db_name,$db);

To, 

$db_select = mysql_select_db("db_name", $db);

Notice the difference in the quotes.

Edit 2

Your code is prone to SQL injection, you are still using MySQL even though it has been deprecated, you should use either MySQLi or PDO with prepared statements.

Not to mention your $_POST data is being passed on to the query without being sanitized, you should start using htmlspecialchars it would make it better and prevent XSS.

Upvotes: 4

Related Questions