PHP error on MySQL insert

[ashworth102680]

I'm sure it's the simplest of issues, but I can't recall why this isn't working.

 

<?php
//setup our insert command
$sql = "INSERT INTO `my_db_name`.`my_table_name` (`id`, `first_name`, `last_name`, `email`, `birthday_month`, `birthday_day`, `phn1`, `phn2`, `phn3`, `ip_address`, `date_entered`) VALUES (NULL, $_POST['fName'], $_POST['lName'], $_POST['email'], $_POST['birthdayMonth'], $_POST['birthdayDay'], $_POST['phn1'], $_POST['phn2'], $_POST['phn3'], $_SERVER['REMOTE_ADDR'], date(YYYY-MM-DD HH:mm:SS));";

//do insert into MySQL
mysql_query($sql);
?>

 

The error I'm seeing is this...

 

Parse error: parse error, expecting `T_STRING' or `T_VARIABLE' or `T_NUM_STRING' in handler_file.php

 

Any help is appreciated!

[mikesta707]

when you have arrays queries you surround them with curly brackets. for example, you would do

{$_POST['fName']}

but for each time you access an array.

 

also you don't need a semi colon at the end of the sql query

 

also you should concatenate the return value for the date function. I don't believe you can just stick functions in strings like that

 

$sql = "blah blah blah " . date(YYYY-MM-DD HH:mm:SS) . ")";

[severndigital]

you need {} around your $_POSTS

 

i would also get those $_POST inputs cleaned and validated before passing them to MySQL .. major security problems the way it is now.

[ashworth102680]

That worked to get rid of the error, but produced another issue. Now I get no errors, but nothing enters my table. Table is empty.

 

$sql = "INSERT INTO `fantasticsams`.`eclub` (`id`, `first_name`, `last_name`, `email`, `birthday_month`, `birthday_day`, `phn1`, `phn2`, `phn3`, `ip_address`, `date_entered`) VALUES (NULL, {$_POST['fName']}, {$_POST['lName']}, {$_POST['email']}, {$_POST['birthdayMonth']}, {$_POST['birthdayDay']}, {$_POST['phn1']}, {$_POST['phn2']}, {$_POST['phn3']}, {$_SERVER['REMOTE_ADDR']}, {date(YYYY-MM-DD HH:mm:SS)});";

[mikesta707]

put or die(mysql_error()) after the query. it is probably failing. if i were to guess it would be the semi colon at the end of the query

[ashworth102680]

The or die() statement is telling me...

 

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '@test.com, 03, 08, 111, 222, 3333, 127.0.0.1, {date('YYYY-MM-DD HH' at line 1

 

Seems to be outputting date()'s curly brackets. I've tried with and without the curly brackets.

[ashworth102680]

Newest query updated with suggestions. Still dying though.

 

$sql = "INSERT INTO `DB`.`TABLE` (`id`, `first_name`, `last_name`, `email`, `birthday_month`, `birthday_day`, `phn1`, `phn2`, `phn3`, `ip_address`, `date_entered`) VALUES (NULL, {$_POST['fName']}, {$_POST['lName']}, {$_POST['email']}, {$_POST['birthdayMonth']}, {$_POST['birthdayDay']}, {$_POST['phn1']}, {$_POST['phn2']}, {$_POST['phn3']}, {$_SERVER['REMOTE_ADDR']}, ".date('YYYY-MM-DD HH:mm:SS').")";

[trq]

Is id an auto incrementing field? If so, remove it from your query all together.

 

Also, when posting code, you should tell us what errors you get.

[PFMaBiSmAd]

date('YYYY-MM-DD HH:mm:SS')

The format string in the above is nonsense.

 

Assuming you are attempting to insert the current date and time, just use the mysql NOW() function in your query.