Question

So this might be dumb, but I can’t get anything to insert into a MySQL on a certain account, and I’ve been staring at this for two hours. I’m a newbie to PHP, so I could very well be doing something dumb. I attached a screen shot of the DB I am trying to INSERT INTO.

Here is what I’m talking about:

(imgur seems to be down for me)

Here’s the code I have, and PhpMyAdmin told me GRANT ALL PRIVILEGES ON . TO …

$fbFirstName = $me['first_name'];
$fbLastName = $me['last_name'];
$fbEmail = $me['email'];
mysql_real_escape_string($fbFirstName,$fbLastName,$fbEmail);

$getuserresult = mysql_query("SELECT * FROM newusers WHERE fbUID=$uid");
$userrowsreturned=mysql_num_rows($getuserresult);
if ($userrowsreturned=0)
  { 
        echo '<br />user already exists, will update something here eventually<br />';
  }
else {
        $sql = mysql_query("INSERT INTO newusers (fbUID,callsAttempted,callsMade,fbEmail,fbFirstName,fbLastName) VALUES ($uid,'1','0',$fbEmail,$fbFirstName,$fbLastName)"); 
        if(!$sql) {
            die("Nope");
        } else {
            echo "1 record added";
        }
        echo '<br />created user<br />';
}

Answer 1

Two things go wrong here. Escaping goes like:

$fbFirstName = mysql_real_escape_string($fbFirstName);
// for all variables

// or, just in one go:
$fbFirstName = mysql_real_escape_string($me['first_name']);

// and for integers, make sure they are actually integers (and prevent mayhem)
$some_id = (int)$me['some_id'];
$uid = (int)$uid;

And when inserting you must quote non-integer values:

$sql = mysql_query("INSERT INTO `newusers`
     (`fbUID`,`callsAttempted`,`callsMade`,`fbEmail`,`fbFirstName`,`fbLastName`)
     VALUES
     ('$uid',1,0,'$fbEmail','$fbFirstName',$fbLastName')"); 

(but you may quote integers as well – you never know if some external id is, or may become, alphanumeric.)