Question

I have a database test with table name table with two columns user & email.
Whats wrong with my below code? Am not able to add the array $u to my db

<?php
    $con = mysql_connect("localhost","root","");
    if (!$con)
      {
      die('Could not connect: ' . mysql_error());
      }

    mysql_select_db("test", $con);

    $user = "safwan";
    $email = "[e-mail]";

    $u = array ( user => $user,
                    email => $email
                   );

    $q =   "INSERT INTO table  VALUES ($u)";

    mysql_query($q) OR die(mysql_error());

    mysql_close($con);
    ?> 

Answer 1

You have a couple of issues:

1. You’re trying to insert an array directly into your database. You need to be accessing the values individually.

2. You should use quotes around strings, that includes when they are keys in an array

3. You need to learn about SQL injections

4. You should consider migrating away from mysql_* functions since they will soon be going away.

5. table is a MySQL keyword and needs backticks if it’s actually the table name

   $user,
   ’email’ => $email
   );

   $q = “INSERT INTO table (user, email) VALUES (‘”.mysql_real_escape_string($u[‘user’]).”‘, ‘”.mysql_real_escape_string($u[’email’]).”‘)”;

   mysql_query($q) OR die(mysql_error());

   mysql_close($con);
   ?>

Or:

<?php
    $con = mysql_connect("localhost","root","");
    if (!$con)
      {
      die('Could not connect: ' . mysql_error());
      }

    mysql_select_db("test", $con);

    $user = "safwan";
    $email = "[e-mail]";

    $q =   "INSERT INTO table (user, email) VALUES ('".mysql_real_escape_string($user)."', '".mysql_real_escape_string($email)."')";

    mysql_query($q) OR die(mysql_error());

    mysql_close($con);
    ?>