sql syntax-error at inserting php post vars

Question

<?php
        $username = $_POST['username'];
        $score = $_POST['score'];

        $mysqlhost = "localhost"; // MySQL-Host angeben
        $mysqluser = "***********"; // MySQL-User angeben
        $mysqlpwd = "***********"; // Passwort angeben

        $connection = mysql_connect($mysqlhost, $mysqluser, $mysqlpwd) or die("Verbindungsversuch fehlgeschlagen");

        $mysqldb="db2507004-seminarfach"; // Gewuenschte Datenbank angeben
        mysql_select_db($mysqldb, $connection) or die("Konnte die Datenbank nicht waehlen.");

        $sql = "INSERT INTO highscore (username, score) VALUES ('".$username."' , '".$score."');";
        $query = "$connection, $sql";
        $db_erg = mysql_query($query) or die("Anfrage fehlgeschlagen: " . mysql_error());
    ?>

always when i try to insert data into my table i get this error:"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Resource id #2, INSERT INTO highscore (username, score) VALUES ('peter silie' , ' at line 1" and i don't know what is wrong with it.

in my table username is a varchar and score an int.

hope someone could help me.

This is wrong: $query = "$connection, $sql"; made it an answer :p — skrilled, Nov 15 '13 at 18:17
@Gumbo i know that thats a big security problem but i am a total beginner to sql and i don't need to worry about security because that table is only for a temporary highscore. but if you'd send me a quick solution to fix that i'd be happy ;) — ntm, Nov 15 '13 at 19:07
@NathanMaier Have a look at [How can I prevent SQL injection in PHP?](http://stackoverflow.com/q/60174/53114) — Gumbo, Nov 15 '13 at 19:10
@Gumbo thanks. i think its one of the most important chapters when learning sql — ntm, Nov 15 '13 at 19:11

score 2 · Answer 1 · answered Nov 15 '13 at 18:20

2

Insert query is:

$sql = "INSERT INTO highscore (username, score) VALUES ('$username' , '$score')";

Then use :

mysql_query($sql);

answered Nov 15 '13 at 18:20

bsnrijal

494
4
7

score 1 · Accepted Answer · answered Nov 15 '13 at 18:18

1

This is wrong: $query = "$connection, $sql";

$query = $sql;

$db_erg = mysql_query($query) or die("Anfrage fehlgeschlagen: " . mysql_error());

answered Nov 15 '13 at 18:18

skrilled

5,350
2
26
48

sql syntax-error at inserting php post vars

2 Answers2