Question

can someone please tell me what is wrong with this query?

     $sql = "INSERT INTO vendors (business_name, address, description, contact_name,
     contact_phone, alt_phone, url, level, use_me) 
     VALUES($_POST['business_name'],
       $_POST['address'],
       $_POST['description'],
       $_POST['contact_name'],
       $_POST['contact_phone'],
       $_POST['alt_phone'],
       $_POST['url'],
       $_POST['level'],
       $_POST['use_me'])";

and when try to execute, i get the error:
Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING @ the line number where starts “VALUES”

Answer 1

One thing noticeable is, in your query you don’t wrap the $_POST[‘variable’] withing single quotes. Those are most likely strings. So in your insert query, you should wrap strings within single quotes. For example:

INSERT INTO TABLE (name,email) values('your_name','your_email');

But what you have in your query will read like the below:

INSERT INTO TABLE (name,email) values(your_name,your_email);

Without the quotes, it will produce error when executed. You should try wrapping as below :

$sql = "INSERT INTO vendors (business_name, address, description, contact_name,
 contact_phone, alt_phone, url, level, use_me) 
 VALUES('".mysql_real_escape_string($_POST['business_name'])."',
   '".mysql_real_escape_string($_POST['address'])."',
   '".mysql_real_escape_string($_POST['description'])."',
   '".mysql_real_escape_string($_POST['contact_name'])."',
   '".mysql_real_escape_string($_POST['contact_phone'])."',
   '".mysql_real_escape_string($_POST['alt_phone'])."',
   '".mysql_real_escape_string($_POST['url'])."',
   '".mysql_real_escape_string($_POST['level'])."',
   '".mysql_real_escape_string($_POST['use_me'])."')";