MySQL Error

PHP MySQL

[SeanF]

Hi:

I have an application written in PHP and MySQL.

A PHP script is uploading contact data to the database and is throwing an error that I can not figure out for the life of me.

The following is the insert command generated by the PHP code:

INSERT INTO pbs_contacts( 'contact_id', 'mgt_co_id', 'active', 'contact_type_id', 'first_name', 'last_name', 'nick', 'address_1', 'city', 'state', 'zip', 'tel', 'email', 'created', 'changed', 'contact_notes' )VALUES( NULL, '1', 'yes', '1', 'Kyle', 'Axxxx', '', '', '', '', '', '(252) xxx-xxxx', '[e-mail]', '2019-5-31', '2019-6-25', 'Uploaded from WAR sheet' )

The error message is:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''contact_id', 'mgt_co_id', 'active', 'contact_type_id', 'first_name', 'last_name' at line 2

Can someone spot the error for me... I've parsed the line a hundred different ways,

Thanks

PS. The actual PHP code is:

$sql_command = 
" INSERT INTO pbs_contacts(
'contact_id',
'mgt_co_id',
'active',
'contact_type_id',
'first_name',
'last_name',
'nick',
'address_1',
'city',
'state',
'zip',
'tel',
'email',
'created',
'changed',
'contact_notes'
)VALUES(
NULL,
'$mgt_co_id',
'yes',
'1',
'$First_Name',
'$Last_Name',
'$Nick',
'$Address',
'$City',
'$State',
'$Zip',
'$Phone',
'$Email',
'$First_contact',
'$last_updated',
'$Notes'
)";

[topr8]

i've no idea, but why are you trying to insert NULL as a value for contact_id?

i imagine that contact_id is probably data type: INT NOT NULL UNIQUE?

[SeanF]

"contact_id" is an auto increment field. Entering a "NULL" generates the next integer. I usually don't include it in the insert command but was trying it here to see if it makes a difference.

[penders]

INSERT INTO pbs_contacts( 'contact_id', 'mgt_co_id', 'active', .....

MySQL doesn't use single-quotes to quote column identifiers/names. You need to use backticks (by default) instead. (Or double-quotes if ANSI_QUOTES is enabled.) Although it doesn't look like you strictly need to quote the column identifiers in this instance since you aren't using reserved words or whitespace in the column identifiers.

[SeanF]

Ah, right... silly mistake. Sometimes you can't see the forest for the trees...

[csdude55]

Since we're talking about it, you might consider using mysql_real_escape_string on the variables you're inserting (or whatever variation of MySQL you're using); eg:

$sql_command = sprintf("INSERT INTO pbs_contacts (contact_id, mgt_co_id, active, first_name,...) VALUES ('%s', '%s', '%s', '%s',...)",
 mysql_real_escape_string($mgt_co_id),
 'yes',
 '1',
 mysql_real_escape_string($First_Name),
 ...);