I keep getting a syntax error and I don't know whats wrong. Can I not call a predetermined string?
$sqlstring= "INSERT INTO friends (friend_id , friend_email , password , profile_name , date_started , num_of_friends)
VALUES (NULL , $email, $password, $name, CURDATE() , 0);";
if $email, $password, $name are all varchar or string,you need to wrap themwith single quote.
$sqlstring= "INSERT INTO friends (friend_id , friend_email , password ,
profile_name , date_started , num_of_friends)
VALUES (NULL , '$email', '$password', '$name', CURDATE() , 0)";
your query is vunerable with SQL Injection, please take time to read the article below to protect from SQL Injction
Remove the last semicolon and surround values with quotes.
$sqlstring= "INSERT INTO friends (friend_id , friend_email , password , profile_name , date_started , num_of_friends)
VALUES (NULL , '$email', '$password', '$name', CURDATE() , 0)";
If you are accepting user input into your query, it is highly dangerous to simply add it into your SQL statement.
If you are using modern PHP, you would use PDO to prepare your statement...
$sth = $dbh->prepare('INSERT INTO friends (friend_id , friend_email , password , profile_name , date_started , num_of_friends)
VALUES (NULL , ?, ?, ?, CURDATE() , 0)');
$sth->execute(array($email, $password, $name));
Or if you want to stick old school, escape them:
$sqlstring = sprintf('INSERT INTO friends (friend_id , friend_email , password , profile_name , date_started , num_of_friends) VALUES (NULL , %s, %s, %s, CURDATE() , 0)',
mysql_real_escape_string($email),
mysql_real_escape_string($password),
mysql_real_escape_string($name)
);
Your updated Query is:
$sqlstring = "INSERT INTO friends (friend_id , friend_email , password , profile_name , date_started , num_of_friends) VALUES (NULL , '$email', '$password', '$name', CURDATE() , 0)";
