Error:You have an error in your SQL syntax;

lmaabd

Hi,

i'm having the following error:
Error:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ' , , , , , , , , , , , , )' at line 3

Can anyone please help me fix this!
Thank you.

<html xmlns="http://www.w3.org//1999/xhtml">
<html>

<head>
<title></title>
</head>

<?php

error_reporting (E_ALL ^ E_NOTICE);
$course=$POST['course'];
$title=$POST['title'];
$fname=$POST['fname'];
$lname=$POST['lname'];
$yearborn=$_POST['yearborn'];

$gender=$POST['gender'];
$ic=$POST['ic'];
$email=$POST['email'];
$hnumber=$POST['hnumber'];
$mnumber=$_POST['mnumber'];

$city=$POST['city'];
$province=$POST['province'];
$country=$POST['country'];
$postcode=$POST['postcode'];

$con=mysql_connect("localhost","root","");
if(!$con)
{
die('could not connect: '.mysql_error());
}
mysql_select_db("groupproject", $con);
$sql="INSERT INTO application(course, title, fname, lname, yearborn, gender, ic, email, hnumber, mnumber, city, province, country, postcode)
VALUES
($course, $title, $fname, $lname, $yearborn, $gender, $ic, $email, $hnumber, $mnumber, $city, $province, $country, $postcode)";
if(!mysql_query($sql,$con))
{
die('Error:' .mysql_error());
}
echo "Your application has been delivered to our department";
mysql_close($con);
?>
</table>
</body>
</html>

bradgrafelman

Few of issues:

User-supplied data should never be placed directly into a SQL query string, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors. Instead, you must first sanitize the data such as with a function like [man]mysql_real_escape_string/man (for string data) or by using prepared statements.
The [man]mysql[/man] extension has been deprecated for some time now in favor of the newer [man]MySQLi[/man] extension (or perhaps even [man]PDO[/man]). New projects should not use the deprecated extension.
String data in SQL queries must be surrounded with quotes (usually single quotes) just as it would in PHP code. Thus, you're missing a bunch of quotes around the strings inside the VALUES() section.
Notice how there's no data in the SQL error message? You never check to see if any data was actually POST'ed (e.g. using [man]isset/man or [man]empty/man) before you attempt to execute the INSERT query.

EDIT: Added #4 above. Also, when posting PHP code, please use the board's [noparse]

..

[/noparse] bbcode tags as they make your code much easier to read and analyze.