syntax when running a 2nd query

[wright67uk]

Would anybody be able to offer advice on a syntax isssue I have?

 

$headers = 'From: [email protected]' . "\r\n" .    'Reply-To: [email protected]' . "\r\n" .    'X-Mailer: PHP/' . phpversion();
$firstname = $_GET['firstname'];
$lastname = $_GET['lastname'];
$companyname = $_GET['companyname'];
$doornumber = $_GET ['doornumber'];
$street = $_GET ['street'];
$town = $_GET['town'];
$postcode = $_GET['postcode'];
$useremail = $_GET ['useremail'];
$telephone = $_GET['telephone'];
$shortcode = substr($postcode,0,2);
$query =mysql_query ("SELECT useremail FROM treesurgeons WHERE postcode like '%" . $shortcode . "%' ORDER BY companyName LIMIT 3");
echo mysql_error();
echo "<p>The email addresses you have requested are;</p>";
while($ntx=mysql_fetch_row($query)) $nt[] = $ntx[0];
echo "$nt[0]<br>$nt[1]<br>$nt[2]<br>"; 
$message = "$firstname $lastname, from $town has searched for your details.\r\nYou may contact them on $telephone.\r\nThankyou.";
$subject = "You Showed Up In The Tree Directory!";
$email = "$nt[0],$nt[1],$nt[2]";
$to = "$email";
mail( "$to", "$subject","$message", "$headers");
$message = 
"Thankyou for using the Tree Directory!\r\nThe email addresses that you have requested are;\r\n$nt[0]\r\n$nt[1]\r\n$nt[2]\r\n";
$email = "$useremail";
$to = "$useremail";
$subject = "Your Tree Directory Search Results";
mail( "$to", "$subject","$message", "$headers"); 
$query =mysql_query 
("INSERT INTO customers 
($firstname, $lastname, $doornumber, $street, $town, $postcode, $useremail, $telephone)
(firstname, lastname, doornumber, street, town, postcode, useremail, telephone)
")										 ;
echo mysql_error();
?></body></html>

 

My error message is;

 

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '678, hbkjh, vgvi, EN7 6PX, [email protected], 879086767869hv) (fir' at line 2

 

This refers to random input which I have typed into my html form.

 

I can assume this error is in relation to;

 

$query =mysql_query 
("INSERT INTO customers 
($firstname, $lastname, $doornumber, $street, $town, $postcode, $useremail, $telephone)
(firstname, lastname, doornumber, street, town, postcode, useremail, telephone)
")

 

as I have just added it. 

 

Please can anyone advise me as to how my syntax should look?

[trq]

Strings need to be surrounded by quotes within SQL queries.

[fenway]

...which would be easy to see if you were looking at raw SQL.

[Muddy_Funster]

this is back to front...

("INSERT INTO customers 
($firstname, $lastname, $doornumber, $street, $town, $postcode, $useremail, $telephone)
(firstname, lastname, doornumber, street, town, postcode, useremail, telephone)
")

should be

("INSERT INTO customers
(firstname, lastname, doornumber, street, town, postcode, useremail, telephone) VALUES
($firstname, $lastname, $doornumber, $street, $town, $postcode, $useremail, $telephone)
")

The others have already told you that you need to put your input strings inside quotes.