Incorrect SQL syntax, no obvious mistakes

Question

The following MySQL statement reports incorrect SQL syntax when run by PHP but I can't find any obvious mistakes in it.

"INSERT INTO {$UserTable} (username, password, email, salt) VALUES ({$Username}, {$Password}, {$Email}, {$Salt});"

I added a few debug functions to my script in order to see what the issue is, but yet to notice the issue.

Final Query

INSERT INTO users (username, password, email, salt) VALUES (TestUser, ea55336ae722b176a64eff46bbf7eeb0f5053a04f5e94670d719656dc496a8a754dd3e36ead83459020021526747b0a9fc82c397a40699e64f37ad2460a61067, TestEmail, EWEQPVVWIGX);

Error message

Unknown column 'TestUser' in 'field list'

@YourCommonSense: Almost, but the description of using PDO is woefully inadequate, as well as being almost a footnote. Plus pretending that the answers are "wrong" is childish at best, lying at worst. At 61k you should know better. — Lightness Races in Orbit, Jul 21 '13 at 20:16

score 2 · Accepted Answer · answered Jun 29 '13 at 10:21

2

Wrap the individual values with single quotes.

 "INSERT INTO {$UserTable} (username, password, email, salt) VALUES ('{$Username}', '{$Password}', '{$Email}', '{$Salt}');"

answered Jun 29 '13 at 10:21

Abhishek Kannan

988
8
16

Any reason for downvoting other answer?? – Yogesh Suthar Jun 29 '13 at 10:28
Someone has downvoted mine too. :\ – Abhishek Kannan Jun 29 '13 at 10:28
Probably @TheCommonSense, trying to draw more attention to his mediocre answer! – Lightness Races in Orbit Jul 21 '13 at 20:18

score 1 · Answer 2 · edited Jun 29 '13 at 10:25

1

Final Query should be

INSERT INTO users (username, password, email, salt) 
VALUES ('TestUser', 'ea55336ae722b176a64eff46bbf7eeb0f5053a04f5e94670d719656dc496a8a754dd3e36ead83459020021526747b0a9fc82c397a40699e64f37ad2460a61067','TestEmail', 'EWEQPVVWIGX');

edited Jun 29 '13 at 10:25

Yogesh Suthar

30,424
18
72
100

answered Jun 29 '13 at 10:23

Timothy Zhang

21
2

score 0 · Answer 3 · answered Jun 29 '13 at 10:23

0

You need to add single quotes around all strings of characters

answered Jun 29 '13 at 10:23

xonorageous

2,281
7
26
35

Incorrect SQL syntax, no obvious mistakes

3 Answers3