Question

This is the code I use to insert the values $id, $str and $name in a database:

$r=mysql_query("INSERT INTO varta(id,data,name) VALUES('$id','$str','$name');");

But I get a syntax error for the above statement. Why is that? Is my syntax really wrong?

Answer 1

Try adding white spaces between your query words and make sure you escape the input:

$id = mysql_real_escape_string($id);
$str = mysql_real_escape_string($str);
$name = mysql_real_escape_string($name);

$r=mysql_query("INSERT INTO varta (id,data,name) VALUES ('$id','$str','$name');");

Or better yet – take a look at MySQLi or PDO and use prepared statements.