PHP insert using select and variable

Question

I am trying to figure out what is wrong with my insert statement. I know SQL pretty well but not much about PHP. My insert statement is below. I always get Database error or invalid. My database is setup correctly since it works on other pages. I think it is something simple such quote marks etc.

$sSQL = INSERT INTO "budget_bdg" ("bgd_grp_ID", "bdg_year", "bdg_alloc" )Select "grp_ID", " . $iFYID ." , "0" from "group_grp";

Look up **prepared statements**, which guard your code against SQL injection. A good place to get started is the [PHP.net manual](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). That will also show you how to write MySQL together with PHP. — Timothy R, Nov 01 '16 at 14:59

Phiter · Answer 1 · 2016-11-01T14:58:39.423

1

If you're referencing a table name or column name, use the backtick instead ` (or do not use it at all, if your column/table name contains no spaces).

$sSQL = "INSERT INTO `budget_bdg`
        (`bgd_grp_ID`, `bdg_year`, `bdg_alloc` )
        values (select `grp_ID`,
                       '$iFYID'
                        0 from `group_grp`";

Keep in mind that this code is unsafe depending on the value of $iFYID.

edited Nov 01 '16 at 14:58

answered Nov 01 '16 at 14:55

Phiter

14,570
14
50
84

*"If you're referencing a table name or column name, use the backtick instead"* - Not entirely true. Unless their table/column names contain spaces, or hyphens or a reserved word; yes. Otherwise they're not needed. Just need to clarify on this ;-) – Funk Forty Niner Nov 01 '16 at 14:57
Thank you Fred. He can indeed use or not use them. – Phiter Nov 01 '16 at 14:58
You're welcome Phiter, *cheers* – Funk Forty Niner Nov 01 '16 at 14:58

score 0 · Answer 2 · edited Nov 01 '16 at 15:33

0

I figure it out.

$sSQL = "INSERT INTO budget_bdg (bdg_grp_ID, bdg_year, bdg_alloc) Select grp_ID,   $iFYID , '0' from group_grp";

edited Nov 01 '16 at 15:33

Andy

49,085
60
166
233

answered Nov 01 '16 at 15:25

Withnoe

115
1
9

PHP insert using select and variable

2 Answers2