Could not execute query

[Liz_SA]

Hi there, I have created a simple form where the details entered into the form are put into a database. Sounds simple enough but the form is not working. I have created many forms like this in the past but can not figure out why it will not work.

Here is my code :

$sql="INSERT INTO $tbl_name(name, surname, telephone, cellphone, email, area, otherarea, solarpoolheating, poolcovers, chlorinators, heatpumps, geysers, other, interestedother, poolsize, otherpoolsize)VALUES('$name', '$surname', '$telephone', '$cellphone', '$email', '$area', '$otherarea', '$solarpoolheating', '$poolcovers', '$chlorinators', '$heatpumps', '$geysers', '$other', '$interestedother', '$poolsize','$otherpoolsize')";

These are the fields in my table in the correct order :
name,surname,telephone,cellphone,email,area,otherarea,solarpoolheating,poolcovers,chlorinators,heatpumps,geysers,other,poolsize,otherpoolsize

If anyone can see where I am going wrong please let me know??

Liz

[bradgrafelman]

Are you sure it's the SQL query that's causing the problem? If so, what is the error message returned by the SQL server?

Where do you define all of those variables you use in your query?

[Liz_SA]

Hi there, the error says "could not execute query"
I define the variables in my php code see below :

$name = $_POST['name'] ;
$surname = $_POST['surname'] ; 
$telephone = $_POST['telephone'] ; 
$cellphone = $_POST['cellphone'] ;  
$email = $_POST['email'] ; 
$area = $_POST['area'] ; 
$otherarea = $_POST['otherarea'] ;
$solarpoolheating = $_POST['solarpoolheating'] ;
$poolcovers = $_POST['poolcovers'] ;
$chlorinators = $_POST['chlorinators'] ;
$heatpumps = $_POST['heatpumps'] ;
$geysers = $_POST['geysers'];
$other = $_POST['other'];
$interestedother = $_POST['interestedother'];
$poolsize = $_POST['poolsize'];
$otherpoolsize = $_POST['otherpoolsize'];

[bradgrafelman]

Well that's not the error returned by the SQL server, which will probably help you out when debugging the SQL query; since the query is failing, you should retrieve the error message generated by [man]mysql_error/man and paste it here for us.

Also, sometimes it helps to visually inspect the query being sent; I would recommend echo'ing out $sql and pasting it for us to see as well.

Finally, you should realize that your script is vulnerable to SQL injection attacks. You sould never place user-supplied data directly into a query; instead, you should sanitize it with a function such as [man]mysql_real_escape_string/man first.

[TF_TheMoon]

The most likely problem is that one of the variables contains an '. As bradgrafelman says, you need to sanitize the data first. Add escape characters as well as checking for other SQL injection