How to fix this SQL syntax error?

Question

How do I fix this error?

"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1."

I'm using wamp server. localhost:81.

<?php
  $conn =mysqli_connect('localhost', 'root' , '','register');

  if(isset($_POST['submit']))
  { 
    $fname=$_POST['FName'];
    $mname = $_POST['UName'];
    $email = $_POST['email'];
    $contact = $_POST['contact'];
    $gender = $_POST['gender'];
    $Password = $_POST['Pass'];
    $Repassword = $_POST['Rpass'];
    $sql = "INSERT INTO registered(FullName,UserName,Email,Contact#,Gender,Password,RPassword) values('$fname','$mname','$email','$contact','$gender','$Password','$Repassword')";

    if ($conn->query($sql) === TRUE) {
      echo "New record created successfully";
      print '<script>alert("Successfully Submit Data!");</script>';
    }
    else{
      echo "Error: " . $sql . "<br>" . $conn->error;
    }
    $conn->close();
  }
?>

`Contact#` as column name? No, and you didn't escape your input, which will lead to SQL Injection. — Raptor, Jun 04 '15 at 06:28
`Contact#` as column name? remove`#` from your table column name. — Alive to die - Anant, Jun 04 '15 at 06:30
Your code is at risk from hackers doing anything they want from your database (reading your entire database, deleting everything from it, adding anything to it, modifying it, etc.). To eliminate this risk use prepared statements. — kojow7, Jun 04 '15 at 06:36

score 3 · Answer 1 · edited May 23 '17 at 11:58

3

I would recommend using backticks (`) around your column names, to prevent SQL from seeing it as something else. You also want to make sure you escape the data as well.

$sql = "INSERT INTO `registered`
(`FullName`, `UserName`, `Email`, `Contact#`, `Gender`, `Password`, `RPassword`)              
VALUES (?, ?, ?, ?, ?, ?, ?)";
$stmt = $mysqli->prepare($sql);
$stmt->bind_param('sssssss', $fname, $mname, $email, $contact, $gender, $Password, $Repassword);
if ( $stmt->exec() ) {
    //Success
} else {
    echo "Error: " . $sql . "<br>" . $conn->error;
}

For more information on SQL Injection, and how it can effect you, please check out this post.

edited May 23 '17 at 11:58

Community

1
1

answered Jun 04 '15 at 06:31

Blue

22,608
7
62
92

Ouhhhhhhhhh Thankxx alot :) Thankkk You so much,,,Its fixed,,Now my data is successfully save,, You great – Hameed Khan Jun 04 '15 at 06:35
@HameedKhan I recommend checking out [this guide](http://stackoverflow.com/tour) for starting on stack overflow. Be sure to accept answers so that you can gain rep and use that for privileges on the website. – Blue Jun 04 '15 at 06:38

score -1 · Answer 2 · answered Jun 04 '15 at 06:31

-1

try this

INSERT INTO `registered`(`FullName`,`UserName`,`Email`,`Contact#`,`Gender`,`Password`,`RPassword`)              
 values('$fname','$mname','$email','$contact','$gender','$Password','$Repassword')";

answered Jun 04 '15 at 06:31

kishan

454
3
10

score -1 · Answer 3 · answered Jun 04 '15 at 06:56

-1

try this

$sql = "INSERT INTO registered(FullName,UserName,Email,Contact#,Gender,Password,RPassword)              
 values($fname,$mname,$email,$contact,$gender,$Password,$Repassword)";

answered Jun 04 '15 at 06:56

cys

1
1

Welcome to stackoverflow. I recommend checking existing answers to ensure that it hasn't been answered already, and consider checking out the [tour](http://stackoverflow.com/tour) page. Your answer is not only incorrect, but it actually makes things worse because you're now not quoting anything that's going into the database, and will most assuredly cause a SQL error on insertion. – Blue Jun 04 '15 at 08:04

How to fix this SQL syntax error?

3 Answers3