Insert - not written field in the table

Question

INSERT INTO `jos1_content` 
  (`title`, `introtext`, `fulltext`, `state`, `sectionid`, `catid`, `attribs`)
VALUES  
  ($title, $introtext, $fulltext, 1, 1, $catid, 5)

The request consists of a PHP script. The output of the variables shows that they are not empty. When phpMyAdmin is requested, an error is displayed:

1064 - You have an error in the SQL syntax; check the manual that matches your version of MySQL server for the correct syntax,

Answer 1

You need to use single quotes to indicate strings in SQL - use:

INSERT INTO `jos1_content` 
  (`title`, `introtext`, `fulltext`, `state`, `sectionid`, `catid`, `attribs`)
VALUES  
  ('". $title ."', '". $introtext ."', '". $fulltext ."', 1, 1, $catid, 5)

Safer means would be to use:

$query = sprintf("INSERT INTO `jos1_content` 
                    (`title`, `introtext`, `fulltext`, `state`, `sectionid`, `catid`, `attribs`)
                  VALUES  
                   ('%s', '%s', '%s', 1, 1, %d, 5)",
        mysql_real_escape_string($title),
        mysql_real_escape_string($introtext),
        mysql_real_escape_string($fulltext),
        $catid);

Link:

• SPRINTF
• MYSQL_REAL_ESCAPE_STRING

Answer 2

You need to surround PHP variables that are inserted into string fields with quotes:

INSERT INTO `jos1_content` 
(`title`, `introtext`, `fulltext`, `state`, `sectionid`, `catid`, `attribs`)
VALUES  
('$title', '$introtext', '$fulltext', 1, 1, $catid, 5)

Answer 3

Read the instructions in the manual for your programming language or use mysql_escape_string.