PHP MYSQL ERROR when inserting data - php

Question

I'm getting the following error :
2016-04-26 15:11:56 --- DEBUG: Error ocurred where inserting user data to the legacy db :Database_Exception [ 0 ]: [1064] You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ')' at line 1 ~ APPPATH/classes/database/mysqli.php [ 179 ]
For the php query :
$result = $usdb->query(Database::INSERT, "INSERT INTO users (id, `password`, group_id , active, created, updated) VALUES ({$user['id']}, {$user['password']}, {$user['group_id']}, {$user['active']}, {$user['created']}, {$user['updated']})");
Here are the column types :
id : int AI PK
password : varchar
group_id : int
active : tinyint
created : int
updated : int

Answer 1

You need to have single quotes ' around your values in your SQL query, assuming they're strings (not integers) in the database.
Columns and table references can be encapsulated with backticks, though they don't have to, assuming they're not using a reserved keyword. Values, on the other hand, generally need single quotes around them (unless, of course, you're preparing your values through prepared statements; or if you're certain the database schema uses the integer type).
Putting single quotes around integers works just as well, so it's probably safe just to surround any value with a single quote, like so:
$result = $usdb->query(
Database::INSERT,
"INSERT INTO users (id, `password`, group_id , active, created, updated)
VALUES (
'{$user['id']}',
'{$user['password']}',
'{$user['group_id']}',
'{$user['active']}',
'{$user['created']}',
'{$user['updated']}'
)
"
);
Note:
You should ALWAYS be using parameterized queries (prepared statements). It is extremely unsafe to inject raw PHP variables into a SQL query. If you have a variable with a single quote, it will break the logic of your SQL statement.
You can read more about prepared statements in the PHP manual.
So what your SQL should really look like is this:
$sql = "
INSERT INTO users (id, `password`, group_id , active, created, updated)
VALUES (
:id,
:password,
:group_id,
:active,
:created,
:updated
)
";
And then bind your actual values into the prepared statement.

Answer 2

Since the password column is of type VARCHAR the value $user['password'] should be encapsulated in single quotes. And since the rest of the columns are of type INT or TINYINT single quotes aren't necessary.
So your query should be like this:
$result = $usdb->query(Database::INSERT, "INSERT INTO users (`id`, `password`, `group_id` , `active`, `created`, `updated`)
VALUES (" . $user['id'] . ", '"
. $user['password'] . "', "
. $user['group_id'] . ", "
. $user['active'] . ", "
. $user['created'] . ", "
. $user['updated']
. ")");
You should use backticks (`) for table and column names, single quotes (') for strings. Backticks are only needed when your table name or column name is a MySQL reserved word, but it's a best practice to avoid reserved words.
Sidenote: Use PDO prepare to prevent your database from any kind of SQL Injection.
From the PDO::prepare
Calling PDO::prepare() and PDOStatement::execute() for statements that will be issued multiple times with different parameter values optimizes the performance of your application by allowing the driver to negotiate client and/or server side caching of the query plan and meta information, and helps to prevent SQL injection attacks by eliminating the need to manually quote the parameters.