Question

I’m trying to run a PHP script, but I keep getting this error whenever I run it.

Error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''id', 'firstname', 'lastname', 'email', 'username', 'password', 'hash', 'active'' at line 1

PHP:

<?php
require('includes/connect.php');

if($_POST['submit'] == true) {

    $firstname = mysql_real_escape_string($_POST['firstname']);
    $lastname = mysql_real_escape_string($_POST['lastname']);
    $email = mysql_real_escape_string($_POST['email']);
    $username = mysql_real_escape_string($_POST['username']);
    $password = mysql_real_escape_string($_POST['password']);
    $hash = mysql_real_escape_string(md5(uniqid(rand(), true)));
    $active = mysql_real_escape_string(0);

    $query = mysql_query(" INSERT INTO users_main ( 'id', 'firstname', 'lastname', 'email', 'username', 'password', 'hash', 'active' ) VALUES ( '', '" . $firstname . "', '" . $lastname . "', '" . $email . "', '" . $username . "', '" . $password . "', '" . $hash . "', '" . $active . "' ) ") or die(mysql_error());

} else {

}

?>

Answer 1

Don’t quote column names with single quotes. MySQL uses backticks for quoting column and table identifiers.

Some special keywords need to be quoted with backticks if used as an identifier, but you have not used any of those. None of your columns require quoting.

 $query = mysql_query(" INSERT INTO users_main ( id, firstname, lastname, email, username, password, hash, active ) VALUES ( '', '" . $firstname . "', '" . $lastname . "', '" . $email . "', '" . $username . "', '" . $password . "', '" . $hash . "', '" . $active . "' ) ") or die(mysql_error());