MySQL INSERT Fatal -> 'PDOException' with message 'SQLSTATE[42000]: - php

Question

I have a function that does an INSERT:
function insertData($data){
global $dbh;
$sql = sprintf(
"INSERT INTO location " .
"(" .
"data1, " .
"data2, " .
"data3" .
") " .
"VALUES ('%s', '%s', '%s')",
$data['data1'],
$data['data2'],
$data['data3']
);
echo "$sql \n";
$adjusted = $dbh->quote($sql);
$stmt = $dbh->prepare($adjusted);
$stmt->execute();
$lastId = $dbh->lastInsertId();
return $lastId;
}
When the function is called, I get this error:
INSERT INTO location (data1, data2, data3) VALUES ('Blah1', 'Blah2', 'Blah3')
Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''INSERT INTO location (data1, data2, data3) VALUES (\'Bl' at line 1' in /var/www/test/lib/saveData.php:59
Stack trace:
#0 /var/www/test/lib/saveData.php(59): PDO->prepare(''INSERT INTO lo...')
#1 /var/www/test/lib/saveData.php(10): insertData(Array)
If I run the insert directly it works fine.
I can't figure out what PDO does not like about my syntax.
UPDATE:
Is there a significant difference between using the paramaterization
$sql = "INSERT INTO location (data1, data2, data3) VALUES (?, ?, ?)";
or
$sql = "INSERT INTO location (data1, data2, data3) VALUES (:data1, :data2, :data3)";
UPDATE 2
function insertData($data){
global $dbh;
$sql = "INSERT INTO location " .
"(" .
"data1, " .
"data2, " .
"data3, " .
"data4" .
") VALUES (?, ?, ?, ?)";
$stmt = $dbh->prepare($sql);
$stmt->execute($data);
$lastId = $dbh->lastInsertId();
return $lastId;
}
UPDATE 3 - A debrief For the sake of other readers
I was being clever with sprintf() based on an example I picked up somewhere.
Using sprintf() to build the sql statement is not the same as using named or anonymous bind parameters, so I used the '?' bind parameter and everything worked fine.
Also, I am stuck building on an old system for now, so the shorthand [] array notation was also interfering with successful completion of the task.
Thanks for the input to those who responded.

Answer 1

You are not preparing your statement correctly. sprtinf and quote are breaking your query. Get rid of them and pass the values to execute
function insertData($data) {
global $dbh;
$sql = 'INSERT INTO location
(
data1,
data2,
data3
) VALUES (:data1, :data2, :data3)';
$stmt = $dbh->prepare($sql);
$stmt->execute(array(
'data1' => $data['data1'],
'data2' => $data['data2'],
'data3' => $data['data3']
));
$lastId = $dbh->lastInsertId();
return $lastId;
}
Update:
I have added named placeholders, but I am still building the array manually. If you are sure that $data contains exactly the number of items matching your placeholders you can pass it in directly to execute.