INSERT Statement not working Concrete5 [closed]

Question

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.

---

Questions asking for code must demonstrate a minimal understanding of the problem being solved. Include attempted solutions, why they didn't work, and the expected results. See also: Stack Overflow question checklist

Closed 8 years ago.

Improve this question

Im trying to insert some values into the DB inside a concrete5 single page and it's telling me that my syntax is wrong. I'm not sure where the syntax is wrong because i went by what was on their website. My code is Below.

<?php defined('C5_EXECUTE') or die("Access Denied.");
$db = Loader::db();
$quantity = $_POST['quantity'];
$product = $_POST['product'];
$vendor = $_POST['vendor'];
$address = $_POST['address'];
$user = $_POST['userName'];
$costcenter = $_POST['costCenter'];
$index = 0;

foreach($quantity as $info){
$num = mysql_real_escape_string($quantity[$index]);
echo "$num";
echo "</br>";
$item = mysql_real_escape_string($product[$index]);
echo "$item";
echo "</br>";
$company = mysql_real_escape_string($vendor[$index]);
echo "$company";
echo "</br>";
$shipping = mysql_real_escape_string($address[$index]);
echo "$shipping";
echo "</br>";
$person = mysql_real_escape_string($user);
echo "$person";
echo "</br>";
$center = mysql_real_escape_string($costcenter);
echo "$center";
echo "</br>";

                $sql = "INSERT INTO Orders (quantity,orderItem,vendor,shippingAddress,userName,costCenter) VALUES $num,$item,$company,$shipping,$person,$center";
                $db->Execute($sql);


$index++;

    }   

?>

Answer 1

Wrap your values in parenthesis

$sql = "INSERT INTO Orders (quantity,orderItem,vendor,shippingAddress,userName,costCenter) VALUES ($num,$item,$company,$shipping,$person,$center)";

Answer 2

You actually have two problems. First, your VALUES list needs to be wrapped by parenthesis. The second problem is your values aren't surrounded by quotes. So when your SQL is dumped out, you're putting strings directly into the list. You can get away with this if you're expecting a number but the strings will fail to insert.

$person = '"' . mysql_real_escape_string($user) . '"';

Try adding that to your inputs and I bet it goes through.

Answer 3

You need parenthesis around the variables after values. Example:

INSERT INTO Orders (col1, col2, col3) VALUES ("value1", "value2", "value3")