Question

I’m trying to create two databases after people fill out a signup form with their username, password, and email.

The first MySQL query below works. It inserts their info in the user table.

The second query doesn’t though. It’s trying to insert an encrypted key in the confirm table that I can use to confirm their account with a confirmation email.

Here’s the PDO exception message:

exception ‘PDOException’ with message ‘SQLSTATE[42000]: Syntax error
or access violation: 1064 You have an error in your SQL syntax; check
the manual that corresponds to your MySQL server version for the right
syntax to use near ‘key, email) VALUES ( ’24’,
‘d96e77df9072c73da2612380a784f51b’, ‘r’ at line 1′ in
C:\xampp\htdocs\tutorspot\sign-up-tutors\index.php:80 Stack trace: #0
C:\xampp\htdocs\tutorspot\sign-up-tutors\index.php(80):
PDOStatement->execute() #1 {main}

if($action['result'] != 'error'){

$password = md5($password . 'salty');

    try
    {
        $sql = 'INSERT INTO user (fullname, username, email, password, active) VALUES (
            :fullname,
            :username,
            :email,
            :password,
            0)';
        $s = $pdo->prepare($sql);
        $s->bindValue(':fullname', $_POST['fullname']);
        $s->bindValue(':username', $_POST['username']);
        $s->bindValue(':email', $_POST['email']);
        $s->bindValue(':password', $password);
        $s->execute();
        //get the new user id
        $userid = $pdo->lastInsertId();
    }
    catch (PDOException $e)
    {
        $error = 'Error inserting signup info.';
        include $_SERVER['DOCUMENT_ROOT'] . '/tutorspot/inc/error.html.php';
        exit();
    }

    //create a random key for confirmation
    $key = $username . $email . date('mY');
    $key = md5($key . 'salty');

    //add info to confirm table

    try
    {   
        $sql = 'INSERT INTO confirm (userid, key, email) VALUES (
            :userid,
            :key,
            :email)';
        $s = $pdo->prepare($sql);
        $s->bindValue(':userid', $userid);
        $s->bindValue(':key', $key);
        $s->bindValue(':email', $_POST['email']);
        $s->execute();
    }
    catch (PDOException $e)
    {
        $error = 'Error inserting confirm info.';
        include $_SERVER['DOCUMENT_ROOT'] . '/tutorspot/inc/error.html.php';
        echo $e;
        exit();
    }
}

Answer 1

key and user are reserved words in SQL syntax. Wrap your columns and table names in backticks. For example:

(`userid`, `key`, `email`)