Error in MySQL syntax: What am i missing?

Question

I get this error when try to execute the code below:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'desc,dir,pais,tel,fax,email,url,pic) VALUES ('lucent','que lio','sadsad','dsadsa' at line 1

<?php 
    include('config.php');
    if(isset($_POST['submit'])) {
        $usuario = $login_session;
        $name = $_POST['empname'];
        $desc = $_POST['empdesc'];
        $dir = $_POST['empdir'];
        $pais = $_POST['empais'];
        $tel = $_POST['emptel'];
        $fax = $_POST['empfax'];
        $email = $_POST['empemail'];
        $url = $_POST['empurl'];
        $pic = 'nopic.png';

        $success = "INSERT INTO empresas
                (usuario,name,desc,dir,pais,tel,fax,email,url,pic) 
            VALUES('$usuario','$name','$desc','$dir','$pais',
                '$tel','$fax','$email','$url','$pic')";

        $data = mysql_query ($success)or die(mysql_error());

    }

You're missing proper escaping, for example. Or prepared statements. Or a non-deprecated mysql api. — Maerlyn, May 07 '14 at 15:27
`desc` is a keyword, if you want to use it as a column name, you need to enclose it in backticks. See this question: http://stackoverflow.com/questions/3993465/selecting-a-column-that-is-also-a-keyword-in-mysql — jmoerdyk, May 07 '14 at 15:28
echo the contents of $success out so you can see what mysql is being told to do. — FreudianSlip, May 07 '14 at 15:28

score 1 · Answer 1 · edited May 23 '17 at 12:28

The syntax error you're experiencing is because desc is a MySQL reserved word.

If you want to use it as a field name, you'll need to quote it;

INSERT INTO empresas(usuario, name, `desc`, dir, pais, tel, fax, email, url, pic) VALUES ...

You should also strongly consider not using the deprecated mysql_* API, the newer APIs like PDO or MySQLi give you access to prepared statements which will prevent SQL injection which your code has problems with.

score 0 · Answer 2 · answered May 07 '14 at 15:28

0

You can't use "desc" as a colum name since it's already in MYSQL's use

answered May 07 '14 at 15:28

B_CooperA

659
1
9
28

Thank you guys, DESC was the problem. Can u add what names i cant use as a Column, besides DESC? – user3574326 May 07 '14 at 15:34
You can't use functions and keywords. You should check them in http://www.mysql.com – B_CooperA May 07 '14 at 15:37

score 0 · Answer 3 · answered May 07 '14 at 15:31

0

Your column name 'desc' is the mysql's reserved word, Check this Mysql Reserved Words

answered May 07 '14 at 15:31

Wit Wikky

1,542
1
14
28

score 0 · Answer 4 · answered May 07 '14 at 15:31

Put backticks for the desc column as follows

$success = "INSERT INTO empresas(usuario,name,`desc`,dir,pais,tel,fax,email,url,pic) VALUES ('$usuario','$name','$desc','$dir','$pais','$tel','$fax','$email','$url','$pic')";

or maybe just use another column name

score 0 · Accepted Answer · answered May 07 '14 at 15:33

Any time you see this:

... for the right syntax to use near...

The error is at the very beginning of what "near" is telling you. In this case it's the word desc which is a reserved word in SQL (for ordering things in descending order). I recommend not using it as a column name (or any other reserved word), but if that's not possible then you'll just need to wrap it in back-ticks to indicate that it's an object name and not a keyword:

INSERT INTO empresas(usuario,name,`desc`,dir,pais,tel,fax,email,url,pic)...

It's often a good idea to wrap object names like this anyway, making queries more explicit. Though honestly you should take this a step further and use something like PDO for building your queries. At the very least, please be aware that your current code is highly vulnerable to SQL injection attacks and start reading this.

Error in MySQL syntax: What am i missing?

5 Answers5