MySQL Insert syntax error - Cant find it!

Question

There's gotta be something small I keep missing here, but I can't find it for the life of me.

$insert = mysql_query("INSERT INTO USERS 
(`FBID`, `FIRST_NAME`, `LAST_NAME`, `GENDER`) 
VALUES ('$fbid', '$firstName', '$lastName', '$gender')");

The error is:

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1' at line 1

Any ideas?

Answer 1

Do any of your names contain single quotes?

Try writing out the value of the query to log/console/debug to ensure that it's what you expect.

Answer 2

You are not having variables correctly escaped. Use mysql_real_escape_string and code like this:

$insert = mysql_query("INSERT INTO USERS (`FBID`, `FIRST_NAME`, `LAST_NAME`, `GENDER`)
   VALUES (
            '".mysql_real_escape_string($fbid)."',
            '".mysql_real_escape_string($firstName)."',
            '".mysql_real_escape_string($lastName)."',
            '".mysql_real_escape_string($gender)."'
          )");

If the variables contain any quotes, they create the problem if you don't properly escape them.

Answer 3

Try wrapping your variables in {}.

'{$fbid}', '{$firstName}', '{$lastName}', '{$gender}'

Otherwise you are going to have to use string concatenation. '".$fbid."','".$firstName."','"...

I'm assuming your variables already contain proper escaped data.

Answer 4

Try doing it like this:

$sql = <<EOL
INSERT INTO USERS (`FBID`, `FIRST_NAME`, `LAST_NAME`, `GENDER`) 
VALUES ('$fbid', '$firstName', '$lastName', '$gender')
EOL;
$stmt = mysql_query($sql) or die("MySQL error: " . mysql_error());

This will preserve the query for you in $sql so you can echo it out elsewhere and see what was actually produced.