PHP MySQL INSERT statement syntax error

Question

I'm having problems with an INSERT statement, and the error only says:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1

It's not helpful at all. The version I have tried so far and failed is:

mysql_query("INSET INTO `cos` VALUES ('".$_GET['prod']."','".$_GET['page']."')");

[needless to say that the two variables when printed show the right values] I've also tried versions with nothing around the table name, with ` or ', a million combinations really and nothing works. Not even with constants or into different tables. It just won't insert anything ever. I've checked the privileges (I'm logging into it with root), and it's all on.

I've tried similar stuff on two different machines with the same server (XAMPP 1.7.7) and it works. I'm completely baffled! What can it be?

Thank you for your time!

Frankie · Accepted Answer · 2012-01-09 09:48:36Z

4

First and foremost, just type INSERT correctly.

Using _GET like that really opens you up to SQL INJECTIONS...

Do take a look into MySQL prepared statements.

It is also considered good practice to name the columns that you're inserting data into. That allows you to, latter on, insert extra-columns and keep application logic.

INSERT INTO cos(rowName1, rowName2) VALUES(?, ?)

Where ? would be prepared statements.

answered Jan 9, 2012 at 9:48

Frankie

25.2k10 gold badges83 silver badges127 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Paul · Accepted Answer · 2012-01-09 09:45:55Z

2

Correct:

mysql_query("INSERT INTO `cos` VALUES ('".$_GET['prod']."','".$_GET['page']."')");

Have you tried passing the $link to mysql_query ?

Like:

mysql_query("INSERT INTO `cos` VALUES ('".$_GET['prod']."','".$_GET['page']."')", $link);

EDIT: And of course you must take some security measures before inserting anything into the database, maybe mysql_real_escape_string() or even prepared statements.

answered Jan 9, 2012 at 9:45

Paul

22.1k8 gold badges63 silver badges77 bronze badges

3 Comments

fyr Over a year ago

You should point out that someone should never ever use user defined parameters directly in SQL statements.

Paul Over a year ago

@FloIancu If that solved your problem, click the check mark near the number on the left of my post.

Rafee Over a year ago

Every one makes mistake! and did you got your answer

Damien · Accepted Answer · 2012-01-09 09:49:57Z

0

You are doing it wrong. Why aren't you escaping the values? Php.net documentation is providing some good and safe working examples:

$query = sprintf("SELECT firstname, lastname, address, age FROM friends 
    WHERE firstname='%s' AND lastname='%s'",
    mysql_real_escape_string($firstname),
    mysql_real_escape_string($lastname));

// Perform Query
$result = mysql_query($query);

So adapted to your code:

$query = sprintf("INSERT INTO `cos` VALUES (%s, %s);", 
        mysql_real_escape_string($_GET['prod']),
        mysql_real_escape_string($_GET['page']));
$result = mysql_query($query);

Please, always escape your values. And use INSERT, not INSET :)

answered Jan 9, 2012 at 9:49

Damien

5,8922 gold badges31 silver badges36 bronze badges

Comments

jogesh_pi · Accepted Answer · 2012-01-09 09:52:48Z

0

first this is you are using INSET make it correct with INSERT like

$pro = mysql_real_escape_string($_GET['prod']);
$page = mysql_real_escape_string($_GET['page']);
mysql_query("INSERT INTO `cos` (column1, column2)
             VALUES ('$pro', '$page')" );

you forget to set the column names...

answered Jan 9, 2012 at 9:52

jogesh_pi

9,7725 gold badges40 silver badges65 bronze badges

Comments

sethathi · Accepted Answer · 2012-01-09 10:36:33Z

0

Try this:

$prod = $_GET['prod'];
$page = $_GET['page'];
mysql_insert("INSERT INTO 'cos' VALUES('$prod','$page)");

This should very well do it :)

answered Jan 9, 2012 at 10:36

sethathi

236 bronze badges

Collectives™ on Stack Overflow

PHP MySQL INSERT statement syntax error

5 Answers 5

Comments

3 Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

Comments

3 Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related