Why I'm getting syntax error in SQL statement for a variable containing email address?

Question

I'm using PHP, MySQL and PHPMyAdmin

Following is the code from PHP file :

$sql = "INSERT INTO user_login (user_id, email, token)
  VALUES ($user_id, $email, $token)";

I got following error for above query :

Error: INSERT INTO user_login (user_id, email, token)
  VALUES (303, mrp7590@kastate.edu, 68e1f6cbea3b7a0b77a28395f4a8fef8449c23b1b00a392aa43451a0bfd5ff0e)<br>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '@kastate.edu, ise152e16e36393037933be10ac8a6f6de9e257a5d85e008bbd379bae20b5f535b)' at line 2

Can some one please correct the mistake I'm making in the above insert query?

Thanks.

SQL expects string values to be quoted... but you shouldn't be injecting values directly into an SQL statement, but using bind vars anyway — Mark Baker, Mar 22 '15 at 13:06

score 3 · Answer 1 · answered Mar 22 '15 at 13:06

3

$sql = "INSERT INTO user_login (user_id, email, token) VALUES ($user_id, '$email', '$token')";

answered Mar 22 '15 at 13:06

trzyeM-

923
8
10

score 1 · Answer 2 · answered Mar 22 '15 at 13:08

you must enclose it with single quotes

$sql = "INSERT INTO user_login (user_id, email, token)
VALUES ($user_id, '$email', '$token')";

like this one

INSERT INTO user_login (user_id, email, token)
VALUES (303,'mrp7590@kastate.edu','68e1f6cbea3b7a0b77a28395f4a8fef8449c23b1b00a392aa43451a0bfd5ff0e')

Why I'm getting syntax error in SQL statement for a variable containing email address?

2 Answers2