Error when inserting into SQL table with PHP

Question

This is my code:

function function() {
$isbn = $_REQUEST["isbn"];
$price = $_REQUEST["price"];
$cond = $_REQUEST["cond"];

$con = mysql_connect("localhost","my_usernam", "password");
if (!$con) die('Could not connect:' . mysql_error());
mysql_select_db("my_database",$con);

$sql="INSERT INTO 'Books' (isbn, price, condition)
VALUES ('$isbn','$price','$cond')";


if (!mysql_query($sql,$con))
 {
 die('Error: ' . mysql_error());
 }

mysql_close($con);
return "It works";

But when run it results in:

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''Books' (isbn, price....

Anyone know why this is happening?

If you have a SQL error, the best approach is usually to output the query you are trying to execute and try it "dry" in a SQL worksheet (such as that in phpMyAdmin); if it doesn't work there either, your problem is in the SQL domain and you can discount the PHP and connection stuff clouding the issue. — lotsoffreetime
– lotsoffreetime, Commented Aug 5, 2010 at 19:42

mvds · Accepted Answer · 2010-08-05 19:37:12Z

3

You should use backticks instead of single quotes for table and field names:

$sql="INSERT INTO `Books` (`isbn`, `price`, `condition`)
    VALUES ('$isbn','$price','$cond')";

will work.

ps. to prevent all kinds of nasty security holes, escape the input fields with:

$isbn = mysql_real_escape_string($_REQUEST["isbn"]);
// etc etc for all fields

answered Aug 5, 2010 at 19:37

mvds

47.4k8 gold badges104 silver badges113 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Scott Saunders Over a year ago

Note that you won't be able to use mysql_real_escape_string() until the connection to the DB is made.

Incognito Over a year ago

Its best if you can work with a framework or at the very least a wrapper function to deal with your SQL injections.

Scott Saunders · Accepted Answer · 2010-08-05 19:41:51Z

0

Wrap table names in backticks, not quotes, and make sure to escape your input for security:

$sql="INSERT INTO `Books` (`isbn`, `price`, `condition`)
VALUES ('" . mysql_real_escape_string($isbn) . "',
      '" . mysql_real_escape_string($price) . "',
      '" . mysql_real_escape_string($cond) . "')";

edited Aug 5, 2010 at 19:41

answered Aug 5, 2010 at 19:36

Scott Saunders

30.5k14 gold badges60 silver badges66 bronze badges

2 Comments

Jake Over a year ago

Sorry, I don't know what you mean

mvds Over a year ago

and now pray that "condition" will never become a reserved keyword in mysql ;-)

Collectives™ on Stack Overflow

Error when inserting into SQL table with PHP

2 Answers 2

2 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related