Question

I’m trying to insert a record into the database but it is giving me an error.

I’m using PHP and MySQL.

I need a successful result, but I’m getting an error and here is my code:

 $Pname = $_POST[Pname];
    $P_Price = $_POST[P_Price];
    $P_Desc = $_POST[P_Desc];
    $P_City = $_POST[P_City];
    $P_Size = $_POST[P_Size];
    $P_Rooms = $_POST[P_Rooms];
    $P_garage = $_POST[P_garage];
    $P_Address = $_POST[P_Address];
    $P_Long = $_POST[P_Long];
    $P_Lat = $_POST[P_Lat];
    $Provinces_idProvinces = $_POST[Provinces_idProvinces];

    // array for JSON response
    $response = array();

        $result = mysql_query("INSERT INTO property(Pname,P_Price,P_Desc,P_City,P_Size,P_Rooms,P_garage,P_Address,P_Long,P_Lat,Provinces_idProvinces)
        VALUES ('".$Pname."',".$P_Price.",'".$P_Desc."','".$P_City."','".$P_Size."','".$P_Rooms."',".$P_garage.",'".$P_Address."',".$P_Long.",".$P_Lat.",".$Provinces_idProvinces."'");

     if ($result) {
            // successfully inserted into database
            $response["success"] = 1;
            $response["message"] = $result ;

            // echoing JSON response
            echo json_encode($response);
        } else {
            // failed to insert row
            $response["success"] = 0;
            $response["message"] = mysql_error();

Here is my error:

{"success":0,"message":"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''','','','',,'',,,'' at line 2"}

I checked everything, but it’s still giving me same error. Please help, it is almost 3 days now.

Here is the MySQL query:

delimiter $$

CREATE TABLE `property` (
  `idProperty` int(11) NOT NULL AUTO_INCREMENT,
  `Pname` varchar(45) DEFAULT NULL,
  `P_Price` double DEFAULT NULL,
  `P_Desc` varchar(45) DEFAULT NULL,
  `P_City` varchar(45) DEFAULT NULL,
  `P_Size` varchar(45) DEFAULT NULL,
  `P_Rooms` varchar(45) DEFAULT NULL,
  `P_garage` int(11) DEFAULT NULL,
  `P_Address` varchar(45) DEFAULT NULL,
  `P_Long` int(11) DEFAULT NULL,
  `P_Lat` int(11) DEFAULT NULL,
  `P_Sold` tinyint(1) DEFAULT '0',
  `Provinces_idProvinces` int(11) NOT NULL,
  PRIMARY KEY (`idProperty`),
  KEY `fk_Property_Provinces` (`Provinces_idProvinces`),
  CONSTRAINT `fk_Property_Provinces` FOREIGN KEY (`Provinces_idProvinces`) REFERENCES `provinces` (`idProvinces`) ON DELETE NO ACTION ON UPDATE NO ACTION
) ENGINE=InnoDB AUTO_INCREMENT=8 DEFAULT CHARSET=latin1$$

Answer 1

There are many problems with Your query:

1. You are not sanitizing the values from user input ($_GET or $_POST) – use at least mysql_real_escape_string for this…
2. Your query contains some values empty thus You have ,,, in Your query… Validate the form after submitting and check that each property has a value set other way set it to '' (empty string) or 0 (zero) or null
3. You use apostrophes and quotes without thinking… Here is Yoyr query (not code formatted to be abble to do bold) – bold are the apostrophes that are wrong:
   INSERT INTO property (Pname, P_Price, P_Desc, P_City, P_Size, P_Rooms, P_garage, P_Address, P_Long, P_Lat, Provinces_idProvinces) VALUES (‘”.$Pname.”‘, “.$P_Price.”, ‘”.$P_Desc.”‘, ‘”.$P_City.”‘, ‘”.$P_Size.”‘, ‘”.$P_Rooms.”‘, “.$P_garage.”, ‘”.$P_Address.”‘, “.$P_Long.”, “.$P_Lat.”, “.$Provinces_idProvinces.“‘”);

After repairing these three errors/mistakes You shoudl be good.

Few recommendations:

1. always sanitize each user input! (this is likely a must not a recommendation)
2. You should validate forms and set default values for the empty fields
3. instead of using nowadays deprecated mysql_* function us at least mysqli_* or PDO.

Additionally, you are using unquoted array indices:

$P_Price = $_POST[P_Price];

Unless P_Price is a constant, you need to quote it:

$P_Price = $_POST['P_Price'];

Activate error reporting to see all the errors you are causing, then fix them:

error_reporting(E_ALL);
ini_set('display_errors', true);