INSERT PHP Statement not working

Question

So, I'm not exactly sure what the problem is, but, when I try to INSERT into a table, it doesn't work.

All the variables are working. I've echoed and tested them, they are working.

$username = $_SESSION['username'];
$update = $_GET['update'];
mysql_query("INSERT INTO updates (username, update) VALUES ('$username', '$update')");

So it must be a problem with my mySQL query. This mySQL query is one of two in the .php folder. If that makes any difference.

• zerkms: 1. mysql_error() 2. google for "sql injections"
• Treffynnon: What do the variables contain? Could it be that you have unescaped apostrophes in there?
• CCates: There is no error, it does not update the database. The database has id, username, update that's it.
• Luca Filosofi: maybe columns properties are wrong.
• CCates: I've proof read them many times over, they are correct.

Answer 1

Error in SQL

There is an error in your SQL. You cannot use MySQL keywords in column names without quoting them.

In this case update needs to be enclosed in backticks:

$query = "INSERT INTO updates (`username`, `update`) 
 VALUES ('$username', '$update')";

SQL injection

Your code is susceptible to SQL injection attacks. You should escape quoted strings that are placed into an SQL statement with mysql_real_escape_string() or bind your data using PHP PDO prepared statements.

$username = mysql_real_escape_string($_SESSION['username']);
$update = mysql_real_escape_string($_GET['update']);

Putting it together

$username = mysql_real_escape_string($_SESSION['username']);
$update = mysql_real_escape_string($_GET['update']);
$query = "INSERT INTO updates (`username`, `update`) 
 VALUES ('$username', '$update')";

I have written little SQLFiddle for you so you can see this in action: http://sqlfiddle.com/#!2/c25b1/1

• CCates: Thanks Treffy, it worked. Surprisingly the first INSERT statement works, but, not the second without the back ticks. Any reason as to why?
• Treffynnon: I am not sure what you mean exactly, but you cannot have column names that are MySQL keywords like SELECT, UPDATE, INSERT, etc.
• CCates: OHH everything makes sense now.

Answer 2

You need to escape the data you are about to insert. You also want to separate the string from the variables. Try something like this:

$username = mysql_real_escape_string($_SESSION['username']);
$update = mysql_real_escape_string($_GET['update']);
mysql_query("INSERT INTO `updates` (username, update) VALUES ('" . $username . "', '" . $update . "')") or die(mysql_error());

That's untested but should work.

• Mike L.: This should work so long as you first mysql_select_db so that you have an active database selected and updates is a valid table in said database.
• CCates: Your mysql_real_escape_string did nothing, the database is not updating. The correct database is selected, and, one table works, but, the other doesn't. I checked for spelling mistakes, anything, and, no dice.
• Jack: Have you made sure you have connected and selected the database successfully, as Mike said. Could you show us more of the file?
• CCates: As I've said before, one table works in the exact same .php file, and updates the database, the other one doesn't.
• Jack: Treffynnon has made a useful answer here, go check that out.

Answer 3

mysql_error() is the best way but you can also echo your query and run it directly against the database to see what is the problem.

$username = $_SESSION['username'];
$update = $_GET['update'];
$query = "INSERT INTO updates (username, update) VALUES ('$username', '$update')";
mysql_query($query);
echo "My Query : $query";

Answer 4

try this:

$username = $_SESSION['username'];
$update = $_GET['update'];
mysql_query("INSERT INTO updates (username, update) VALUES ('+$username', '+$update')");

also is better is create a variable to put the query string and then you make the query