Member Avatar for issaru07

i got this error when i trying to submit a form..

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'order(firstname,lastname,email,address,city,postalcode,country,totalprice,paymen' at line 1

appreciate if you could assist me..

$sql2= mysql_query("INSERT INTO order(firstname,lastname,email,address,city,postalcode,country,totalprice,payment,status) VALUES( '$_POST[firstname]', '$_POST[lastname]', '$_POST[email]', '$_POST[address]', '$_POST[city]', '$_POST[postalcode]',  '$_POST[country]', '0', '$_POST[payment]', 'Successful')")or die(mysql_error());
  • 3 Contributors
  • 3 Replies
  • 187 Views
  • 8 Hours Discussion Span
  • Latest Post Latest Post by Member #120589

Dani AI

Generated

Two separate problems are visible in the thread. correctly flagged a name conflict: using a table name that matches an SQL keyword will produce a syntax error. Renaming the table (for example to something like user_order) or quoting the identifier prevents that. The follow‑up error showing fragments like '1', '5') indicates the generated SQL string was malformed when PHP interpolated the POST values — hinted at this parsing issue. Embedding array elements directly inside a double‑quoted SQL string can yield unexpected results unless the values are inserted correctly.

Practical, low‑risk debugging steps that reveal the exact cause:

  • Temporarily capture and inspect the final SQL string before execution (log or echo it while testing) to see exactly what MySQL receives.
  • Check for typos in the form field names and confirm all expected $_POST keys exist.
  • Ensure numeric columns are passed as numbers (or cast) and that string values are properly quoted.
  • Avoid building queries by concatenating raw input; that both causes parsing headaches and opens SQL injection holes.

Recommended fix: use parameterized queries (mysqli or PDO) and bind values. This eliminates interpolation problems and secures input. Example using PDO:

$pdo = new PDO('mysql:host=localhost;dbname=yourdb;charset=utf8mb4', 'dbuser', 'dbpass', [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
]);
$stmt = $pdo->prepare(
    'INSERT INTO user_order (firstname, lastname, email, address, city, postalcode, country, totalprice, payment, status)
     VALUES (:fn, :ln, :email, :addr, :city, :pc, :ctry, :price, :pay, :status)'
);
$stmt->execute([
    ':fn' => $_POST['firstname'],
    ':ln' => $_POST['lastname'],
    ':email' => $_POST['email'],
    ':addr' => $_POST['address'],
    ':city' => $_POST['city'],
    ':pc' => $_POST['postalcode'],
    ':ctry' => $_POST['country'],
    ':price' => 0,
    ':pay' => $_POST['payment'],
    ':status' => 'Successful',
]);

Notes: the braces trick mentioned by can fix interpolation in the short term, but moving away from the old mysql_* functions to prepared statements is the robust, future‑proof solution.

Recommended Answers

All 3 Replies

Member Avatar for pritaeas

order is a reserved word, use backticks.

Member Avatar for issaru07

order is a reserved word, use backticks.

thanks.

i changed my table name to user_order earlier

and i got this error n couldnt find 1,5
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1', '5')' at line 1

Member Avatar for Member #120589

If you're using raw post data - NOT recommended - you need to use braces:

'$_POST[firstname]'

should be:

'{$_POST['firstname']}'

(and for all of them)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.