1

I am new to PDO and I'm just writing a test page to take $_POST data from a simple form and insert it into MySQL through a prepared statement, but I keep getting error messages. Here is the php:

$DBH = new PDO("mysql:host=localhost;dbname=randomDB", 'user', 'password');
$DBH->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_WARNING );

$newUserStmt = $DBH->prepare("INSERT INTO 'userbasicinfo' ('email', 'passHash', 'birthday', 'phoneNumber') VALUES (?, ?, ?, ?)");
$newUserStmt->bindParam(1, $email);
$newUserStmt->bindParam(2, $passHash);
$newUserStmt->bindParam(3, $birthday);
$newUserStmt->bindParam(4, $phoneNumber);


$email = $_POST['email'];
$passClear = $_POST['password'];
$passHash = password_hash($passClear, PASSWORD_DEFAULT);
$birthday = $_POST['birthday'];
$phoneNumber = $_POST['phone'];
$newUserStmt->execute();

$DBH = null;

And this is the warning:

Warning: PDOStatement::execute(): SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''userbasicinfo' ('email', 'passHash', 'birthday', 'phoneNumber') VALUES ('billy@' at line 1 in C:\xampp\htdocs\test.php on line 18

steele
  • 107
  • 1
  • 11
  • You can't quote your table name or table columns, because when you do that it expects a string. Lose the quotes or use backticks. `INSERT INTO userbasicinfo (email, passHash, birthday, phoneNumber)` (Thanks Michael). – Ben Fortune Oct 28 '13 at 13:44
  • 3
    Not just _"don't need to"_, but rather _cannot_. See http://stackoverflow.com/questions/11321491/when-to-use-single-quotes-double-quotes-and-backticks – Michael Berkowski Oct 28 '13 at 13:45
  • It doesn't belong to PDO, by the way – Your Common Sense Oct 28 '13 at 14:05

1 Answers1

4

Use backticks instead of single-quotationmarks for tablenames (and columnnames): 

$newUserStmt = $DBH->prepare("INSERT INTO `userbasicinfo` (`email`, `passHash`, `birthday`, `phoneNumber`) VALUES (?, ?, ?, ?)");

With single-quotationsmarks your Database-Server interpretate the tablename as a string.

Hecke29
  • 766
  • 6
  • 18