[RESOLVED] INSERT statement error

focus310

Hello:

I'm trying to run an INSERT and I'm receiving the following message:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'current_date, app_complete_name, app_date, relation, phone, email, client_name, ' at line 1

This is what my statement looks like:

$query = "INSERT INTO client(current_date, app_complete_name, app_date, relation, phone, email, client_name, dob, refdate,
                              refsrce, eye, hair, height_ft, height_inches, weight, marks, gender, religion, hand, medicaidno, ssn, current_home,
                              contact_person, contact_phone, contact_address, contact_city, contact_state, contact_zip, place_date, curr_level,
                              no_level, case_worker, county, agency_address, agency_city, agency_sate, agency_zip, agency_phone, cell_phone,
                              fax, supervisor, sup_phone, investigator, inv_phone, sheriff, sheriff_phone)
          VALUES (CURRENT_DATE(), '$_SESSION[realname]', '$_SESSION[app_date]', '$_SESSION[relation]', '$_SESSION[phone]', '$_SESSION[email]',
                  '$_SESSION[client_name]', '$_SESSION[dob]', '$_SESSION[refdate]', '$_SESSION[refsrce]', '$_SESSION[eye]', '$_SESSION[hair]', 
                  '$_SESSION[height_ft]', '$_SESSION[height_inches]', '$_SESSION[weight]', '$_SESSION[marks]', '$_SESSION[gender]', 
                  '$_SESSION[religion]', '$_SESSION[hand]', '$_SESSION[medicaidno]', '$_SESSION[ssn]', '$_SESSION[current_home]', 
                  '$_SESSION[contact_person]', '$_SESSION[contact_phone]', '$_SESSION[contact_address]', '$_SESSION[contact_city]', 
                  '$_SESSION[contact_state]', '$_SESSION[contact_zip]', '$_SESSION[place_date]', '$_SESSION[curr_level]', '$_SESSION[no_level]', 
                  '$_SESSION[case_worker]', '$_SESSION[county]', '$_SESSION[agency_address]', '$_SESSION[agency_city]', '$_SESSION[agency_state]', 
                  '$_SESSION[agency_zip]', '$_SESSION[agency_phone]', '$_SESSION[cell_phone]', '$_SESSION[fax]', '$_SESSION[supervisor]', 
                  '$_SESSION[sup_phone]', '$_SESSION[investigator]', '$_SESSION[inv_phone]', '$_SESSION[sheriff]', '$_SESSION[sheriff_phone]')";

$result = mysql_query ($query) or die (mysql_error());

I'm not seeing the error in line 1 of the statement.

Does anyone else see something that I'm missing? I checked the syntax with other INSERT queries I ran and I never had a problem.

Thanks for the help.

contrasites

Try putting single quotes on each side of the values like 'current_date', 'app_complete_name', 'app_date'....etc

bradgrafelman

contrasites wrote:
Try putting single quotes on each side of the values like 'current_date', 'app_complete_name', 'app_date'....etc

Actually, you're close to being right.

I'm betting the problem is that the column "current_date" has the same name as a MySQL function (which you actually use in your query... :p). To solve this, try adding backticks (``), not single quotes, around the column names.

EDIT: Also, I don't know how that session data was populated, but make sure you're not leaving yourself vulnerable to SQL injection attacks - always sanitize user-supplied data with a function such as [man]mysql_real_escape_string/man before using it in a SQL query.

EDIT2: Woops! Totally forgot that this thread had already been marked as resolved. Any chance you can tell us what the fix was?

focus310

Hi,

Thank you for replying. The fix to this thread was exactly what you said. I was using the current_date which is a MySQL function. I changed it to todays_date and now everything works.

By the way, in my query, where exactly do I place the mysql_real_escape_string() ?

bradgrafelman

focus310 wrote:
By the way, in my query, where exactly do I place the mysql_real_escape_string() ?

Well.. it's not actually in any one place. [man]mysql_real_escape_string[/man] returns a modified string like other functions such as [man]strtoupper/man.