[Resolved] Syntax Check

[Sharif]

I don't know really know if I am doing this correctly, some people helped me a few days back on inserting data using {} so I came up with this:

$sql = "INSERT INTO users (date_registered, username, password, ";
$sql .= "first_name, last_name, address1, address2, country, ";
$sql .= "phone, email, dob, sex) ";
$sql .= "VALUES ('$date_registered', '{$_POST['username']}', '$MD5', ";
$sql .= "'{$_POST['first_name']}', '{$_POST['last_name']}', '{$_POST['address1']}', '{$_POST['address2']}', '{$_POST['country']}', ";
$sql .= "'{$_POST['phone']}', '{$_POST['email']}', '{$_POST['year']-$_POST['month']-$_POST['day']}', '{$_POST['sex']}')";
$query = mysql_query($sql) or die(sql_error());

Anything wrong?

[LordShryku]

Originally posted by Sharif
Anything wrong?

You tell us. Does it work?

[tomhath]

You have single quotes inside of single quotes. That never worked for me :mad:

'{$_POST['username']}'

[Sharif]

Ok I fixed the query and this is what I got:

$sql = "INSERT INTO users (date_registered, username, password, ";
$sql .= "first_name, last_name, address1, address2, country, ";
$sql .= "phone, email, dob, sex) ";
$sql .= "VALUES ('$date_registered', {$_POST['username']}, '$MD5', ";
$sql .= "{$_POST['first_name']}, {$_POST['last_name']}, {$_POST['address1']}, {$_POST['address2']}, {$_POST['country']}, ";
$sql .= "{$_POST['phone']}, {$_POST['email']}, {$_POST['year']}-{$_POST['month']}-{$_POST['day']}, {$_POST['sex']})";
$query = mysql_query($sql) or die(sql_error());

Why am I getting this error:

MySQL Error: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near ' New York, 777, [e-mail], 1978-11-15, Male)' at line 1 for the query: INSERT INTO users (date_registered, username, password, first_name, last_name, address1, address2, country, phone, email, dob, sex) VALUES ('2003-11-06', tes, '74b87337454200d4d33f80c4663dc5e5', sharf, kari, 3, , New York, 777, [e-mail], 1978-11-15, Male).

[LordShryku]

The SQL needs to be quoted. I think tomhath was saying to use

"{$POST['username']}"
or
'{$POST["username"]}'

I usually seperate the vars from the string though, like this

$sql = "INSERT INTO users 
        (date_registered, username, password, first_name, last_name, 
         address1, address2, country,phone, email, dob, sex
        ) 
        VALUES ('".$date_registered."', 
                '".$_POST['username']."', 
                '".$MD5."', 
                '".$_POST['first_name']."', 
                '".$_POST['last_name']."', 
                '".$_POST['address1']."', 
                '".$_POST['address2']."', 
                '".$_POST['country']."',
                '".$_POST['phone']."', 
                '".$_POST['email']."', 
                '".$_POST['year']."-".$_POST['month']."-".$_POST['day']."', 
                '".$_POST['sex']."'
               )";