MySQL Syntax error

blizzardguy

Hello,

I have been looking at this for hours trying to figure out where the syntax is wrong with this.. maybe a set of fresh eyes on this will detect the error!

A fatal MySQL error occured.

Query: INSERT INTO merchants (merch_name, website, address, city, state, zip, cat1, cat2, cat3, desc, cust_service_info, op_hours, contact_fname, contact_lname, contact_phone, contact_email, aff_management, aff_manager, aff_phone, aff_email, aff_link, aff_pixel, aff_code) VALUES ('test', '', '', '', '', '', '129', '', '', 'test', '', '', '', '', '', '', '', '', '', '', '', '', '')

Error: (1064) You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'desc, cust_service_info, op_hours, contact_fname, contact_lname, contact_phone, ' at line 1

laserlight

desc is a keyword, so you should quote it. This would normally be done with double quotes, but in the case of MySQL, use backticks (`).

By the way, have you considered having zero length strings be the default values, thus you can leave out many of the fields that are to be set to a zero length string?

blizzardguy

Thank you for your help. I'm a bit rusty on MySQL since i havent coded anything in it for the past couple years. I simply changed the field name to description to solve the problem.. thank you so much for your help.

as for the 0 length fields.. usually they will be mostly filled up.. the query is constructed from the post of a form like this:

if($POST){
$first = true;
$key = "";
$value = "";
foreach($POST as $k => $v) {
if ($first) {
$keys .= $k;
$values .= "'" . $v . "'";
$first = false;
} else {
$keys .= ", " . $k;
$values .= ", '" . $v . "'";

}
}
$q = "INSERT INTO merchants (" . $keys . ") VALUES (" . $values . ")";
$result = mysql_q($q);
}

THANKS again for your help!

laserlight

blizzardguy wrote:
I'm a bit rusty on MySQL since i havent coded anything in it for the past couple years.

Ah, then it is my pleasure to announce to you that the MySQL extension is no longer the only kid on the block where MySQL database access is concerned. Consider using the MySQLi extension or PDO extension instead. Both facilitate the use of prepared statements, which can be used as a superior escaping mechanism to mysql_real_escape_string().