Simple MySQL Syntax Error

[radiator251]

I'm in the process of learning MySQL and have a syntax error that I think is pretty simple, but I can't figure out how to fix it.

This is from the php file that a form calls via POST. The relevant code is this:

mysql_query("INSERT INTO venues 
(name, type, image_url, address1, address2, state, city, region, neighborhood, zip, description) VALUES(".$_POST['name'].", ".$_POST['type'].", ".$_POST['image_url'].", ".$_POST['address1'].", ".$_POST['address2'].", ".$_POST['state'].", ".$_POST['city'].", ".$_POST['region'].", ".$_POST['neighborhood'].", ".$_POST['zip'].", ".$_POST['description'].")") or die(mysql_error());

...and I get an error saying the syntax near the form entries for region, neighborhood, zip, and description is wrong. IE, if I write "Manhattan" for the region, "Harlem" for the neighborhood, "10000" for the zip and "Description" for the description, the error says:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ' , manhattan, harlem, 10000, Description)' at line 2

I'm guessing it's something at the end of the query, but I'm not familiar enough with MySQL to figure it out. Any ideas?

Thanks.

[topr8]

doesn't the query have to end with a semi-colon?

btw, you are asking for trouble directly entering POST's into sql without validating/cleaning them first.

[phranque]

if the description is multiple words it probably needs to be quoted.
to be safe you might try quoting all values.

[radiator251]

I'm just using this as a test; I plan to add clean-up functions later after I'm sure it works. Also, I've been testing with the description as one word and it still does not work, but what do you mean by quoting?

Any other ideas? I'm sure this is just a simple mistake...

[topr8]

>>but what do you mean by quoting?
", ".$_POST['description'].")

would be
", '".$_POST['description']."')