getting error check ur mysql syntax near 'order(`pcode`)

Question

i used `` for column name though im getting error... my code is

$sql = "INSERT INTO order(`pcode`) VALUES ('$pcode')";

if(!mysql_query($sql,$con))
die('cant connect ' .mysql_error());

Not directly related but you are exposing yourself to SQL injection. You should consider prepared statements and parametrized queries: http://stackoverflow.com/questions/60174/best-way-to-prevent-sql-injection-in-php — mihaisimi, Jun 27 '12 at 13:04
Also try upgrading to PDO http://php.net/manual/en/book.pdo.php, it is a much nicer extension for SQL, as the mysql extension is now deprecated — Kris, Jun 27 '12 at 13:05

Kris · Accepted Answer · 2012-06-27T13:08:13.523

5

Order is a reserved word for the "ORDER BY" clause try

"INSERT INTO `order`(pcode) VALUES ('$pcode')";

Note: Please ensure $pcode is being run through mysql_real_escape_string, or better yet look into the PDO extension and their prepared queries

edited Jun 27 '12 at 13:08

answered Jun 27 '12 at 13:00

Kris

thnx .. it works.. im tryinf all possible ways using ` ` bt not used in table name.. big relief aftr two days – Milan Delvadia Jun 27 '12 at 13:23

score 0 · Answer 2 · answered Jun 27 '12 at 13:08

0

if order is your table name and pcode is your column name then you can use this:

$sql = sprintf("INSERT INTO `order` (pcode) VALUES('%s')", $pcode);

answered Jun 27 '12 at 13:08

Gabriel Baker

1

The language is the language listed for the question, PHP, but sprintf is pretty universal – Gabriel Baker Jun 27 '12 at 13:09

2 Answers2