[SOLVED] INSERT INTO sql using php variables

[crazytigger]

Sirs, I am having difficulty getting my script to work, it seems fine and i get no error messages but no data is exported to the database(SQL)

 

I am trying to use variables in the INSERT INTO statement because i wish to add some sanitize functions later on. Before i began using the variables ( like this: '$_POST[comment_firstname]') for each of the columns it worked.

 

<?php
include( 'config.php' );

	$db = @mysql_connect("$dbhost", "$dbuser", "$dbpasswd")
	or die( 'Could not connect to database: '.mysql_error() );

	@mysql_select_db($dbname)
	or die( 'Could not select database: '.mysql_error() );

$firstname = $_POST[comment_firstname];		
$lastname = $_POST[comment_lastname];
$email = $_POST[comment_email];
$phone = $_POST[comment_phone];
$location = $_POST[comment_location];
$message = $_POST[comment_message];
$mailing = $_POST[commentaddtomailing];

$sql = "INSERT INTO contact (id, firstname, lastname, email, phone, location, message, mailing).
VALUES ('NULL','$firstname','$lastname','$email','$phone','$location','$message','$mailing')";
$sql = mysql_query($sql);


mysql_close


?>

 

Ive searched around and googled however the examples i found did not use variables. Any advice would be greatly appreciated

 

Regards

 

CT

[per1os]

$sql = "INSERT INTO contact (id, firstname, lastname, email, phone, location, message, mailing).
VALUES ('NULL','$firstname','$lastname','$email','$phone','$location','$message','$mailing')";
$sql = mysql_query($sql) OR DIE(mysql_error()); 

 

Will give you an error near the 'NULL'

 

$sql = "INSERT INTO contact (id, firstname, lastname, email, phone, location, message, mailing).
VALUES (NULL,'$firstname','$lastname','$email','$phone','$location','$message','$mailing')";
$sql = mysql_query($sql) or DIE(mysql_error());

 

Should not produce an error since NULL is not encapsulated around single quotes and is not taken literally.

[crazytigger]

Thank you for your timely reply. In fact both examples produce the same error message:

 

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '. VALUES (NULL,'a','test','somewhere@bla','12345678','anywhere','test message 10' at line 1

 

But at least this shows the variables from the form are being parsed correctly.

 

I am trying to understand the problem however i feel i need further assistance please.

 

 

[kenrbnsn]

You have an extra "." at the end of the first line, remove it:

<?php
$sql = "INSERT INTO contact (id, firstname, lastname, email, phone, location, message, mailing)
VALUES (NULL,'$firstname','$lastname','$email','$phone','$location','$message','$mailing')";
$sql = mysql_query($sql) or DIE("Problems with the query:<pre>$sql</pre>" . mysql_error());
?>

 

Ken

[crazytigger]

Oh goodness how silly.. using jEdit it automatically concats the lines for me.. i had added it thinking i needed it when i bought the line down because it was getting too long.

 

Well spotted thank you so much.