Question

I am trying to see what is wrong with this it says it is expecting a ‘]’ but i do not see the problem in my mySQL here is the line it says it is messing up on.

('$_POST[first_name]','$_POST[last_name]','$_POST[email]','$_POST[phone_number]','$_POST[event_name]','$_POST[event_category]','$_POST[event_ description]','$_POST[event_admission]','$_POST[event_amount]',$event_start_date,$event_end_date,'$_POST[event_location]','$_POST[event_family]')";

Here is the full code:

$sql="INSERT INTO events_main (first_name, last_name, email, phone_number, event_name, event_category, event_description, event_admission, event_amount, event_start_date, event_end_date, event_location, event_family)VALUES('$_POST[first_name]','$_POST[last_name]','$_POST[email]','$_POST[phone_number]','$_POST[event_name]','$_POST[event_category]','$_POST[event_description]','$_POST[event_admission]','$_POST[event_amount]','$event_start_date','$event_end_date','$_POST[event_location]','$_POST[event_family]')";

Answer 1

The reason why you get the error is because of event_ description; the space shouldn’t be there.

However, you should use something like this to properly escape your data before saving them in the database:

$escaped_values = join(',', array_map(function($v) {
    return "'" . mysql_real_escape_string($v) . "'";
}, array(
    $_POST['first_name'],
    $_POST['last_name'],
    $_POST['email'],
    $_POST['phone_number'],
    $_POST['event_name'],
    $_POST['event_category'],
    $_POST['event_description'],
    $_POST['event_admission'],
    $_POST['event_amount'],
    $event_start_date,
    $event_end_date,
    $_POST['event_location'],
    $_POST['event_family'],
)));

$sql = "INSERT INTO .... VALUES ($escaped_values)";

It gets even easier with prepared statements, as the escaping is done for you 🙂