Insert into MySQL Table PHP

Question

I am having some trouble making a simple form to insert data into a MySQL table. I keep getting this SQL error:

\"Error: You have an error in your SQL

Answer 1

<form action="database.php" method="post">
   Item Number: <input type="text" name="ItemNumber">
   Stock: <input type="text" name="Stock">
   <input type="submit" name="submit">
</form>`

Answer 2

Please learn to use parameter binding. You are creating code with security vulnerabilities.

Here's how to do your code in mysqli:

$sql = "INSERT INTO current stock (ItemNumber, Stock) VALUES (?, ?)";

if (!($stmt = mysqli_prepare($con, $sql))) {
    die('Error: ' . mysqli_error($con));
}

if (!mysqli_stmt_bind_param($stmt, "ii", $_POST[ItemNumber], $_POST[Stock])) {
    die('Error: ' . mysqli_stmt_error($stmt));
}

if (!mysqli_stmt_execute($stmt)) {
    die('Error: ' . mysqli_stmt_error($stmt));
}

It's easier to use bound parameters than to get all confused with quotes-within-quotes.

Answer 3

?php
  $conn=new mysqli("localhost","root","","inventory")
  or die("not connected".mysqli_connect_error());
  if(isset($_POST['submit']{
    $ItemNumber=$_POST['ItemNumber'];
    $Stock=$_POST['Stock'];
    $sql="insert into current stock(ItemNumber,Stock) values('$ItemNumber','$Stock')";
    $query=mysqli_query($conn,$sql);
    if($query){
      echo"1 row inserted";
    }else{
      echo mysqli_error($conn);
    }
  }
?>

Answer 4

try this

you should not use quotes of parameter around POST . and you should use them inside POST

       $sql = "INSERT INTO `current stock` (ItemNumber, Stock)
           VALUES
         ('".$_POST['ItemNumber']."', '".$_POST['Stock']."' )";

you should escape your variables before you insert them to mysql like that

• Note that the example does not call mysqli_real_escape_string. You would only need to use mysqli_real_escape_string if you were embedding the string directly in the query, but I would advise you to never do this. Always use parameters whenever possible.

Answer 5

You have an extra quote and you need ticks around your table name as it contains a space.

INSERT INTO current stock ('ItemNumber', 'Stock')
VALUES
('$_POST[ItemNumber]','$_POST[Stock]'')";

should be:

INSERT INTO `current stock` (`ItemNumber`, `Stock`)
VALUES
('$_POST[ItemNumber]','$_POST[Stock]')";

FYI, you also wide open to SQL injections