MY SQL insert syntax error

Question

I know what a syntax error is but i cant find the problem in my syntax. I did the sql in phpmyadmin first and not ive just copied and put variables in.

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's new carving chisels. 1 x 13mm 4-point finishing claw Chisel. Southern St' at line 3

Code:

public function insert_row($vendor, $product_link, $product_title, $product_desc, $product_price){
    mysql_query("INSERT INTO `crawl_products` ( `vendor` , `product_link` , `product_title` , `product_desc` , `product_price` )
        VALUES (
        '$vendor', '$product_link', '$product_title', '$product_desc', '$product_price'
        )") or die(mysql_error());
}

Many Thanks.

Error is coming due to the fact that you have single quote in your data. You should use mysql_real_escape_string like function before concating values. Better use mysqli and binding. — Sumit Gupta, Sep 25 '13 at 11:33

score 1 · Answer 1 · answered Sep 25 '13 at 11:34

The tables need no Grave accents, e.g. "`vendor`" should just be "vendor", and try to write the variables like this:

VALUES ( '".$vendor."',

it should work then.

And what sythnet wrote about mysql_query($con applies to mysqli_qurey, not to mysql_query

score 1 · Accepted Answer · answered Sep 25 '13 at 11:36

You need to apply mysql_real_escape_string over each variable before running the insert query

public function insert_row($vendor, $product_link, $product_title, $product_desc, $product_price){

    $vendor = mysql_real_escape_string($vendor);
    $product_link = mysql_real_escape_string($product_link);
    $product_title = mysql_real_escape_string($product_title);
    $product_desc = mysql_real_escape_string($product_desc);
    $product_price = mysql_real_escape_string($product_price);

    mysql_query("INSERT INTO `crawl_products` ( `vendor` , `product_link` , `product_title` , `product_desc` , `product_price` )
        VALUES (
        '$vendor', '$product_link', '$product_title', '$product_desc', '$product_price'
        )") or die(mysql_error());
}

score 0 · Answer 3 · edited May 23 '17 at 12:21

0

Escape the inputs. Use mysql_real_escape_string.

Also have look at : Why shouldn't I use mysql_* functions in PHP?

edited May 23 '17 at 12:21

Community

1
1

answered Sep 25 '13 at 11:37

Ashwini Agarwal

4,828
2
42
59

MY SQL insert syntax error

3 Answers3