MySQL Syntax Error On Line 1(2)

Question

I am a beginner web developer. This is my first attempt at connecting to a MySQL database. I am getting the following syntax error (after successfully connecting to the db?). I know there are similar questions out there, but I think I must be missing something specific. Thanks for your patience!

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Name, Email, Password, Gender) VALUES ('','','', '')' at line 1

<?php
$con=mysqli_connect("localhost", "shiftedr_admin", "", "shiftedr_whosthedeeusers");
// Check connection
if (mysqli_connect_errno())
  {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
 }
$sql="INSERT INTO Users2 (Full Name, Email, Password, Gender)
VALUES
('$_POST[fullname]','$_POST[email]','$_POST[password]', '$_POST[gender]')";

if (!mysqli_query($con,$sql))   
  {
  die('Error: ' . mysqli_error($con));
 }
 echo "1 record added";

mysqli_close($con);
 ?>

I've double checked that the values match how they are in the DB exactly and case sensitive. "Full Name" is how it is in both the Users2 table and the php I'm calling from.

The HTML Code I am using to submit the script is as follows:

<div class="reformed-form" style="width: 400px; border-right-color:">
<form method="post" name="accountcreation" id="accountcreation" action="insertnewaccounts.php" style="background-color:#CCFFFF;">
<center><h1 style="position:relative;left:0px;"> Account Creation </h1>

    <table>
    <tr>
    <td align="right"> Full Name: </td>
    <td align="left"><input type="text" id="fullname nameerror"  name="fullname" min="4" class="spacing" placeholder="Your Full Name"/> </td></tr>
    <tr>
    <td align="right">Email</td>
    <td align="left"><input type="text" id="email" name="email"  min="5" placeholder="@" />        </td></tr>
    <tr>
    <td align="right"> Password </td>
    <td align="left"><input type="text" id="Password" name="password"  class="spacing" placeholder="Minimum 6 Characters"/>         </td></tr>
    <tr>
    <td align="right"> Confirm Password </td>
    <td align="left"><input type="text" id="confirmpassword passworderror" class="spacing" name="pwc" placeholder="Confirm Password"/></td></tr>
    <tr>
    <td align="right"> Owner's' Gender: </td>
    <td align="left"><input type="radio"> Male <input type="radio">Female </td></tr>
    </table>
    </center>
    </dl>
<input type="submit" value="Check" /></center>
</form>

Please don't use $_POST['fullname'] directly in your query. What if my name was: '); DROP TABLE Users2; -- ? Please see: bobby-tables.com — gen_Eric
– gen_Eric, Commented Sep 4, 2013 at 17:27
Hazmat, would it help if I split it into two fields and limited the character type input? — Peege151
– Peege151, Commented Sep 4, 2013 at 17:39
What you should do is use mysqli_prepare. php.net/manual/en/mysqli.quickstart.prepared-statements.php — gen_Eric
– gen_Eric, Commented Sep 4, 2013 at 17:41

Explosion Pills · Accepted Answer · 2013-09-04 17:27:08Z

3

Full Name has a space in it so the syntax is invalid. If the actual column name is "Full Name," (ouch) you need backticks around it.

INSERT INTO Users2 (`Full Name`,

Your code is vulnerable to injection and you are using a deprecated MySQL API. Switch to using properly parameterized queries with PDO or mysqli.

answered Sep 4, 2013 at 17:27

Explosion Pills

192k56 gold badges341 silver badges417 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

MySQL Syntax Error On Line 1(2)

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related