views:

98

answers:

4

I'm trying to enter values into a database table using a form and a PHP function. The PHP seems to be fine as the SQL statement it creates looks okay, but the database always throws up an error. This is the SQL statement that my code has generated (with arbitrary values):

INSERT INTO Iteminfo ('itemName', 'itemSeller', 'itemCategory', 'itemDescription', 'itemPrice', 'itemPostage', 'itemBegin', 'itemEnd', 'buynow', 'itemPicture')
values ('gorillaz album', 'ben', 'music', 'new one ', '5.00', '1.00', '2010-03-15 14:59:51', '2010-03-16 14:59:51', '0', 'http://www.thefader.com/wp-content/uploads/2010/01/gorillaz-plastic-beach.jpg')

This throws up an error both when I use the PHP function to evaluate the query and also when I use phpMyAdmin to enter the query manually. However, I can't see anything wrong with it. Can anyone shed some light on this? All of the fields are VARCHAR values, except for itemPrice and itemPostage (which are stored as DECIMAL(4,2)) and the itemBegin and itemEnd, which are stored as DATETIMEs.

+8  A: 

Try

INSERT INTO Iteminfo (itemName, itemSeller, itemCategory, itemDescription, itemPrice, itemPostage, itemBegin, itemEnd, buynow, itemPicture)
values ('gorillaz album', 'ben', 'music', 'new one ', '5.00', '1.00', '2010-03-15 14:59:51', '2010-03-16 14:59:51', '0', 'http://www.thefader.com/wp-content/uploads/2010/01/gorillaz-plastic-beach.jpg')

Column names should not be quoted.

Dathan
I usually quote them in `-quotes (in MySQL). I once developped a site on my own local MySQL-server, which was a different version then the live one, to which I transferred my site. It took me quite a while to find out that one of my column names was a MySQL keyword in the newer version... :)
Lex
you could also try inserting the values with the phpMyAdmin, and then get the SQL generated there
Jhonny D. Cano -Leftware-
@Lex Agreed! Using the backtick to escape entity names is definitely a best practice. I primarily use SQL Server 2005, and one of our tables has a field named Group. It didn't take many times running a query with that field un-escaped for me to start escaping everything!
Dathan
+4  A: 

Don't quote the column names in the specified list after the table (itemName, itemSeller, etc.)

Joe
+1  A: 

Your column names shouldn't be strings

try removing '' in column definitions

Morten Anderson
+1  A: 

Per a comment above by middus, The 5.00 and 1.00 should NOT be quoted as they are decimals and not strings.

Buggabill