Question

I have been trying for several days to get the proper formatting for what I wish to execute.

The goal is to insert rows into a MYSQL table which is previously created. The table may be a mix of strings and integers, and as we know MYSQL requires quotes around strings for insertion while it does not for integers. So then, the proper way to insert something into a table of an integer and two strings would be:

insert into table values(number, "string", "string");

I wish the values to be php variables. However when I input the variables, the code will no longer produce the result when I check in MYSQL. The table will be created, but it will be empty. So it must be this statement that does not work.

This is my actual code for the function to insert it:

function insertRow($db, $new_table, $ID, $Partner, $Merchant)

    $insert = "INSERT INTO ".$new_table. " VALUES (1,'Partner','Merchant')";

    $q = mysqli_query($db, $insert);

It works like this, but fills the entire table with 1, partner and merchant for every row as many times as I choose.

I’ve also tried several variations like this

function insertRow($db, $new_table, $ID, $Partner, $Merchant)

    $insert = "INSERT INTO ".$new_table. " VALUES(" .$ID. "," ."'$Partner'". ","."'$Merchant'".")";

    $q = mysqli_query($db, $insert);

I’ve also tried these:

Passing PHP variables into MySQL

but none have worked to actually insert the tables into the rows.

Does anyone have an alternative way of doing this?

Answer 1

You need to start your debugging very simply, and work from there. The first guess I would have is that you’re not setting your parameter values properly that are passed into the function.

Try this:

function insertRow($db, $new_table, $ID, $Partner, $Merchant) {
  $ID=1;
  $Partner = 'Partner';
  $Merchant = 'Merchant';
  $insert = "INSERT INTO $new_table " .
    " VALUES($ID,'$Partner','$Merchant')";
  $q = mysqli_query($db, $insert);
  if (!$q) die(mysqli_error($db));
}

Does that work? If so, then the problem is that your parameter values are not being properly set.

Note that I’ve also added some error reporting in there 😉

Note, though, that it’s not a good idea to create your SQL like this. It is wide open to SQL injection. Much better to look into using Prepared Statements:

  $prep = mysqli_prepare($db, "insert into " . $new_table . " values (?,?,?)");
  $prep->bind_param("iss", $ID, $Partner, $Merchant);
  $prep->execute();

See the PHP documentation on mysqli_prepare for more details.