0
<?php
    include 'db_connection.php';

    $name = $_POST['name'];
    $password = $_POST['password'];
    $email = $_POST['email'];
    $phone = $_POST['phone'];

    $conn = OpenCon();
    echo "<br><br>Connected Successfully";

    $sql = "INSERT INTO 'customer'('customer name','password','email','phone number') VALUES([$name], [$password], [$email], [$phone]);";

    if (mysqli_query($conn, $sql)) {
        echo "New record created successfully";
    } else {
        echo "Error: " . $sql . "<br>" . mysqli_error($conn);
    }
?>

This code is giving me the error while trying to use INSERT statement. I created the DBConenction using $conn variable.

Mathew Dony
  • 376
  • 4
  • 11

2 Answers2

0

Avoid unwanted semicolon at the end and remove the single quote from table name. Try with the following. Also since 2 of your fields contain space in between them you can avoid using single quote and use `` backticks .

$sql = "INSERT INTO customer (`customer name`,password, email, `phone number`) VALUES ('$name','$password','$email', '$phone') ";
Oops
  • 1,373
  • 3
  • 16
  • 46
  • Glad to help :) . You can accept this answer if you find it useful. – Oops Mar 18 '20 at 09:15
  • This opens the code to [SQL injection](https://stackoverflow.com/questions/332365/how-does-the-sql-injection-from-the-bobby-tables-xkcd-comic-work). You should use [prepared statements](https://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php) instead. – El_Vanja Mar 18 '20 at 13:37
0

Solution for your code

I assume that your name, password, email and phone are strings.

So they must appear between quotes in your final requests, so 

$sql = "INSERT INTO 'customer'('customer name','password','email','phone number') VALUES([$name], [$password], [$email], [$phone]);";

Change to

$sql = "INSERT INTO 'customer'('customer name','password','email','phone number') VALUES('[$name]', '[$password]', '[$email]', '[$phone]')";

In addition, and to avoid SQL injection, you should escape the string you get from the POST request, so you should replace

$name = $_POST['name'];
$password = $_POST['password'];
$email = $_POST['email'];
$phone = $_POST['phone'];

by

$name = mysqli_real_escape_string($conn, $_POST['name']);
$password = mysqli_real_escape_string($conn, $_POST['password']);
$email = mysqli_real_escape_string($conn, $_POST['email']);
$phone = mysqli_real_escape_string($conn, $_POST['phone']);

And moved after the creation of your connexion.

Better solution (if you can)

The best solution to handle databases in PHP is using prepared request, or even better: Using an ORM like Doctrine. It will be far more secure and reliable.

redheness
  • 346
  • 1
  • 8
  • Have you verified the name of the columns in your SQL statement ? Names with spaces seems quite crazy – redheness Mar 18 '20 at 09:15
  • Or can you output the generated SQL (with random values to avoid disclosing password) ? – redheness Mar 18 '20 at 09:18
  • 1
    Escaping with `mysqli_real_escape_string` will do very little, if not next to nothing to prevent [SQL injection](https://stackoverflow.com/questions/332365/how-does-the-sql-injection-from-the-bobby-tables-xkcd-comic-work). You should use [prepared statements](https://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php) instead. – El_Vanja Mar 18 '20 at 13:38