SQL error in syntax

Question

I am getting this error:

Error: INSERT INTO users (username, password, mail, balance, depost1, depost2, depost3) VALUES (test, 4f4dfc9a3bec784d456fafabc725977e, test@test.test, '0', '0', '0', '0') You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '@test.test, '0', '0', '0', '0')' at line 2`.

So, I looked in my syntax, but I can't find any thing that is wrong. Here is my code:

<?php
inculde('config.php');
$conn = new mysqli($servername, $username, $password, $dbname);
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
} 
$sql = "INSERT INTO users (username, password, mail, balance, depost1, depost2, depost3)
VALUES ($user, $result, $mail, '0', '0', '0', '0')";
if ($conn->query($sql) === TRUE) {
    echo "New record created successfully";
} else {
    echo "Error: " . $sql . "<br>" . $conn->error;
}
$conn->close();
?>

`$sql = "INSERT INTO users (username, password, mail, balance, depost1, depost2, depost3) VALUES ('$user', '$result', '$mail', '0', '0', '0', '0')";` — Suman, Jul 20 '17 at 14:29
this code is totally unsafe to be used in a live environment. Use a prepared statement and `password_hash()/password_verify()` if you want to keep your data safe and db intact. — Funk Forty Niner, Jul 20 '17 at 14:36
you also used quotes where you most likely don't need them, most likely being integers for `int` column types, whereas the string literals require them to be quoted. — Funk Forty Niner, Jul 20 '17 at 14:37
you also made a typo => `inculde` which should have read as `include`, but that would have thrown you a completely different error to which wasn't included in the original post, so that IMHO is irrelevant to the post's closure. — Funk Forty Niner, Jul 20 '17 at 14:39

score 1 · Accepted Answer · edited Jul 20 '17 at 14:34

1

You have missed the quotes in query

<?php
    inculde('config.php');
    $conn = new mysqli($servername, $username, $password, $dbname);
    if ($conn->connect_error) {
        die("Connection failed: " . $conn->connect_error);
    } 
    $sql = "INSERT INTO users (username, password, mail, balance, depost1, depost2, depost3)
    VALUES ('$user','$result', '$mail', '0', '0', '0', '0')";
    if ($conn->query($sql) === TRUE) {
        echo "New record created successfully";
    } else {
        echo "Error: " . $sql . "<br>" . $conn->error;
    }
    $conn->close();
?>

edited Jul 20 '17 at 14:34

Funk Forty Niner

74,450
15
68
141

answered Jul 20 '17 at 14:32

Suneel Kumar

1,650
2
21
31

1

they also made a typo here `inculde` to which you should have spotted, but as I noted in comments under their question, would have been another issue that wasn't part of the original post. I only [edited your answer](https://stackoverflow.com/revisions/45217736/2) about a misplaced quote earlier. – Funk Forty Niner Jul 20 '17 at 14:40
@Fred-ii- Agree and Thanks – Suneel Kumar Jul 20 '17 at 14:43

score 0 · Answer 2 · answered Jul 20 '17 at 14:31

0

Use single quote in value in your Query

$sql = "INSERT INTO users (username, password, mail, balance, depost1, depost2, depost3) VALUES ('$user', '$result', '$mail', '0', '0', '0', '0')"

answered Jul 20 '17 at 14:31

Sunil Rajput

960
9
19

score 0 · Answer 3 · answered Jul 20 '17 at 14:32

When placing variables directly in a string, they are not automatically wrapped in quotes, even if they are strings.

You will have to change your query to the following:

$sql = "INSERT INTO users (username, password, mail, balance, depost1, depost2, depost3) VALUES ('$user', '$result', '$mail', '0', '0', '0', '0')";

SQL error in syntax

3 Answers3