Parse Error for a MySQL query in PHP

Question

I got this error:

Parse error: syntax error, unexpected T_CONSTANT_ENCAPSED_STRING in   
          /home/oznola38/public_html/code/classifieds.php on line 30

for this code:

$qry = "INSERT INTO classified
    (name, address, city, state, zip, phone, fax, email, 
                section, weeks, ad_text, link, display)
 VALUES
           ('".$name."','".$address."','".$city."','".$state"','".$zip."',
                '".$phone."','".$fax."','".$email."','".$section."','".$weeks."',
                '".$ad_text."','".$link."','N')";

Any suggestions?

Answer 1

Here comes the obligatory SQL Injection Warning:

Your code is unsafe. Don't be like Little Bobby Table's School. Escape your values. Blah blah blah.

Past that, you messed up somewhere along the lines with the quotes. Rewrite it to make it cleaner:

$qry = sprintf("
    INSERT INTO classified
        (name, address, city, state, zip, phone, fax,
         email, section, weeks, ad_text, link, display)
    VALUES
        ('%s','%s','%s','%s','%s','%s','%s',
         '%s','%s','%s','%s','%s','N')
", $name, $address, $city, $state, $zip, $phone, $fax,
   $email, $section, $weeks, $ad_text, $link);

But seriously: protect your code. If you are using the old school mysql_* functions, you should pass all your variables through mysql_real_escape_string at the very least. Nowadays, though, it is best practices to use a library like mysqli or PDO and take advantage of prepared statements.

The reason this is so important is because you have to consider what would happen if I was trying to get into your code. If I passed something like this to the name field of your query:

Gotcha'); DROP TABLE classified; --

Your query might end up looking like this:

INSERT INTO classified
    (name, address, city, state, zip, phone, fax,
     email, section, weeks, ad_text, link, display)
VALUES
    ('Gotcha'); DROP TABLE classified; -- the rest doesn't matter because this is a comment

Which would do, you know, bad things.

Answer 2

This part looks like the problem:

'".$state"',

Should be:

'".$state."',

Paolo Bergantino's suggested code looks much better tho!