Php Insert Into Mysql Syntax Error

I'm having trouble submitting some data to MySQL via php, i get the following error: 'Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL s

Solution 1:

TableNames are Identifiers so they should not be quoted with single quotes. Since the tableName you've used is not a reserved keyword, you can simply remove those wrapping quotes around,

INSERTINTO student (FirstName, LastName....

When you wrap something with single quotes, it forces that object to become a string literal. So when identifiers are wrap with single quotes, it means that they are not identifier anymore.

The server throws an exception because INSERT INTO expects an identifier not string literal.

When you have accidentally used a table name which is a MySQL Reserved Keyword, don't use single quote to delimit the identifier but with backticks.

As a sidenote, the query is vulnerable with SQL Injection if the value(s) of the variables came from the outside. Please take a look at the article below to learn how to prevent from it. By using PreparedStatements you can get rid of using single quotes around values.

• How to prevent SQL injection in PHP?

Solution 2:

change your query to

$sql = "INSERT INTO student (FirstName, LastName, DOB, EmergencyContact, Address,                City, State, ZIP, CellPhone, HomePhone, Guardian, InNeighborhood)
    VALUES
   ('$firstname', '$lastname', '$dob', '$emergencycontact', '$address', '$city', '$state', '$zip', '$cellphone', '$homephone', '$guardian', '$inneighborhood')";

dont use quotes around table names

Solution 3:

Looks like you are missing a few things too:

You Have: ($firstname',

Should be: (missing ' at beginning) ('$firstname',

But even then, you may want to use " (quotes) and escape them like so:

(\"$firstname\",

You also have a lot of space between address and city on your INSERT INTO line... Address, City

And yes, you should escape your mysql field names with a `