[RESOLVED] T_STRING ERROR

[dglynch21]

Hi,

I am new to coding PHP by myself, I am huge on open-source and making alterations is easy. I have taken on making my own PHP/MYSQL project and I keep getting an error. I have been on W3Schools.com and googled different ways and can not figure out what is wrong. So anyone see what I am doing wrong or can you point me where I can learn? Both would be great too!

Parse error: syntax error, unexpected T_STRING in /home/user/public_html/ae.process.php on line 16

<?php include('config.php') ?>
<?php
$fname = $_POST['fname'];
$middle = $_POST['middle'];
$lname = $_POST['lname'];

// Add Employee
mysql_query (INSERT INTO personnel(fname, middle, lname) VALUES('$fname', '$middle', '$lname');

// Close DB Connection
mysql_close($db_con);
?>

[bradgrafelman]

Your SQL query should be enclosed in quotes - it's no different than any other [man]string[/man] in PHP.

Also note that user-supplied data should never be placed directly into a SQL query, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors. Instead, you must first sanitize it with a function such as [man]mysql_real_escape_string/man (for string data) or use prepared statements. See this man page for more info: [man]security.database.sql-injection[/man].

Oh, and welcome to PHPBuilder!

[dglynch21]

Thank you so much! Everything worked great!