Writing to MySQL problem

[obel]

Hi, i started PHP for like 1 week ago. So i wondered if i could make something usefull with these skills that, i now had acquired. I decided to make a contact card file. Where i could store my contacts.
But for some reason it won't work. My code is very basic, i would not start to put any fancy things in it before i got it working. I've been puzzling around with it now for hours. I hope any off you guys might could help me.
The values is in danish, but that should not be a problem.

I get this error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'by, mobil, arbejde, mail, kommentar)VALUES(Mads Obel, Jørgensen, Hjulets Kvt. 10' at line 1

First, my form:

<form action="person_submit.php" method="POST">
 <table width="500" border="0" cellspacing="0" cellpadding="3">
  <tr>
    <td width="115">Fornavn(e)</td>
    <td width="373"><input name="navn" type="text" size="50"></td>
  </tr>
  <tr>
    <td>Efternavn(e)</td>
    <td><input name="efternavn" type="text" size="50"></td>
  </tr>
  <tr>
    <td>Adresse</td>
    <td><input name="adresse" type="text" size="50"></td>
  </tr>
  <tr>
    <td>Postnummer</td>
    <td><input name="postnr" type="text" size="50"></td>
  </tr>
  <tr>
    <td>By</td>
    <td><input name="by" type="text" size="50"></td>
  </tr>
  <tr>
    <td>Mobilnummer</td>
    <td><input name="mobil" type="text" size="50"></td>
  </tr>
  <tr>
    <td>Arbejdsnummer</td>
    <td><input name="arbejde" type="text" size="50"></td>
  </tr>
  <tr>
    <td>E-Mail</td>
    <td><input name="mail" type="text" size="50"></td>
  </tr>
  <tr>
    <td valign="top">Kommentar</td>
    <td><textarea name="kommentar" cols="50" rows="10"></textarea></td>
  </tr>
  <tr>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
  </tr>
  <tr>
    <td>&nbsp;</td>
    <td><input type="submit" value="Indsæt"></td>
  </tr>
</table>

</form>

Then the "submit-file":

<?php

include "config.php";

$navn = $_POST['navn'];
$efternavn = $_POST['efternavn'];
$adresse = $_POST['adresse'];
$postnr = $_POST['postnr'];
$by = $_POST['by'];
$mobil = $_POST['mobil'];
$arbejde = $_POST['arbejde'];
$mail = $_POST['mail'];
$kommentar = $_POST['kommentar'];
?>
<?php
mysql_query("INSERT INTO kartotek (navn, efternavn, adresse, postnr, by, mobil, arbejde, mail, kommentar)VALUES($navn, $efternavn, $adresse, $postnr, $by, $mobil, $arbejde, $mail, $kommentar)") or die("Der er sket en fejl: ".mysql_error());
?>

[paulnaj]

Hi there,

The error is in the SQL statement. I would imagine that it's that 'by' is a reserved word in MySQL (see reserved words).

One way around this is to use back-ticks to enclose table names and field names ...

<?php
mysql_query("INSERT INTO `kartotek` (`navn`, `efternavn`, `adresse`,`postnr`, `by`, `mobil`, `arbejde`, `mail`, `kommentar`)VALUES($navn, $efternavn, $adresse, $postnr, $by, $mobil, $arbejde, $mail, $kommentar)") or die("Der er sket en fejl: ".mysql_error());
?>

There could be other problems, but try this first.

Paul

[obel]

Well it still don't work. I have tried to rename the varible $by to $city. But still nothing, i really don't get it. This should be close to most simple PHP/MySQL ever :S

[tams]

Try changing this

"INSERT INTO kartotek (navn, efternavn, adresse, postnr, by, mobil, arbejde, mail, kommentar)VALUES($navn, $efternavn, $adresse, $postnr, $by, $mobil, $arbejde, $mail, $kommentar)"

to

"INSERT INTO kartotek (navn, efternavn, adresse, postnr, by, mobil, arbejde, mail, kommentar)VALUES('$navn', '$efternavn', '$adresse', '$postnr', '$by', '$mobil', '$arbejde', '$mail', '$kommentar')"

[obel]

tams wrote:

Try changing this

"INSERT INTO kartotek (navn, efternavn, adresse, postnr, by, mobil, arbejde, mail, kommentar)VALUES($navn, $efternavn, $adresse, $postnr, $by, $mobil, $arbejde, $mail, $kommentar)"

to

"INSERT INTO kartotek (navn, efternavn, adresse, postnr, by, mobil, arbejde, mail, kommentar)VALUES('$navn', '$efternavn', '$adresse', '$postnr', '$by', '$mobil', '$arbejde', '$mail', '$kommentar')"

Thanks, this solved the problem. I will keep it in mind the next time i will have to insert data into a database 🙂

[bradgrafelman]

Also note that numerical values don't need quotes though string values do (just like in PHP).

Additionally, your script appears to be vulnerable to SQL injection attacks (as well as the possibility of quotes breaking your SQL query). To solve this, always sanitize user-supplied database when querying a SQL DB, either by using [man]mysql_real_escape_string/man or an extension such as [man]PDO[/man] which offers prepared statements that do the sanitizing for you.

Don't forget to mark this thread resolved, too.