Error when inserting data into MySQL database with PHP

Question

I get the following error

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '16:45:40, 2012-12-18 16:45:40, Renovated Stone house in Perast, first line, 2012' at line 1

This is the SQL query where the problem is

$sql =  "INSERT INTO `wp_posts` (`post_author`, `post_date`, `post_date_gmt`, `post_title`, `post_modified`, `post_modified_gmt`, `xml_id`)";
$sql .= " VALUES ({$postAuthor}, {$postDate}, {$postDate}, {$title}, {$postModified}, {$postModified}, {$xmlId});";

You need to sanitize your input.

Daniel
– Daniel

2013-02-01 10:09:33 +00:00
Commented Feb 1, 2013 at 10:09 — Daniel
– Daniel, Commented Feb 1, 2013 at 10:09

Yogu · Accepted Answer · 2013-02-01 10:11:21Z

3

The values have to be enclosed in quotation marks, and you have to make sure that there are no quotation marks in the values.

The best way to do this is using prepared statements, e.g. with the PHP Data Objects.

answered Feb 1, 2013 at 10:11

Yogu

9,5655 gold badges40 silver badges64 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Orel Eraki · Accepted Answer · 2013-02-01 10:13:36Z

3

This line:

$sql .= " VALUES ({$postAuthor}, {$postDate}, {$postDate}, {$title}, {$postModified}, {$postModified}, {$xmlId});";

Should be:

$sql .= " VALUES ('$postAuthor', '$postDate', '$postDate', '$title', '$postModified', '$postModified', '$xmlId')";

Remove the wrapped: ', where the column type isn't a varchar.

Also, you must validate you're escaping the special characters inside the variables. mysql_real_escape_string

answered Feb 1, 2013 at 10:13

Orel Eraki

12.2k4 gold badges31 silver badges38 bronze badges

1 Comment

Yogu Over a year ago

No, it shouldn't. Or at least you have to escape the variables before.

Miqdad Ali · Accepted Answer · 2013-02-01 10:30:39Z

1

It should work

$sql =  "INSERT INTO `wp_posts` (`post_author`, `post_date`, `post_date_gmt`, `post_title`, `post_modified`, `post_modified_gmt`, `xml_id`)";
$sql .= " VALUES ('$postAuthor', '$postDate', '$postDate', '$title', '$postModified', '$postModified', '$xmlId')";

answered Feb 1, 2013 at 10:30

Miqdad Ali

6,1577 gold badges34 silver badges50 bronze badges

Collectives™ on Stack Overflow

Error when inserting data into MySQL database with PHP

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related