Using PHP POST variables when adding data to mySQL? [duplicate] - php

Question

This question already has answers here:
PHP parse/syntax errors; and how to solve them
(20 answers)
Closed 7 years ago.
I want to take the POST data from the three form tags and upload variables to mySQL. When I run the PHP on the second page I get a "Parse error: syntax error, unexpected 'VALUES' (T_STRING) in C:\xampp\htdocs\PHPtest\signUpTRUE.php on line 32"
I can try to post the HTML Form Tags and the PHP..
The HTML form tags:
<div id="headingText"><p> New Fan Club Registration</p></div>
<form action="signUpTRUE.php" method="post" >
<div id="firstNameField">First Name:<input type="text" name="fname"></br></div>
<div id="lastNameField">Last Name: <input type="text" name="lname"></br></div>
<div id="emailField">Email: <input type="text" name="email"></br></div>
<div id="checkboxField"><input type="checkbox" name="terms" value="agree" id="checkboxField" required> *Agree to the terms and conditions </input></div>
<button type="submit" value="Submit" id="button">Submit</button>
</form>
Here is the PHP running calls to mySQL:
<?php
$FN = htmlspecialchars($_POST['fname']);
$LN = htmlspecialchars($_POST['lname']);
$EM = htmlspecialchars($_POST['email']);
$servername = "localhost";
$username = "root";
$password = "password";
$dbname = "fanClub";
$conn = new mysqli($servername,$username,$password,$dbname);
if ($conn->connect_error) {
die("Connection Failed: " . $conn->connect_error);
}
$sql = "INSERT INTO userInfo (email, firstname, lastname)"
VALUES ($EM, $FN, $LN);
if ($conn->query($sql) === TRUE) {
echo "<p> data enrty has been logged like whoa</p>";
}else {
echo"<p>error in code.</p>";
}
$conn-close();
?>
I get the
"Parse error: syntax error, unexpected 'VALUES' (T_STRING) in C:\xampp\htdocs\PHPtest\signUpTRUE.php on line 32"
when I try to run this.
Thanks a lot for looking at this :D!

Answer 1

$sql = "INSERT INTO userInfo (email, firstname, lastname)"
VALUES ($EM, $FN, $LN);
This line is wrong. It should be:
$sql = "INSERT INTO userInfo (email, firstname, lastname) VALUES ($EM, $FN, $LN)";
Anyways your code is vulnerable to sql injection

Answer 2

The statement
$sql = "INSERT INTO userInfo (email, firstname, lastname)"
VALUES ($EM, $FN, $LN);
should be
$sql = "INSERT INTO userInfo (email, firstname, lastname)
VALUES ($EM, $FN, $LN)";
(Note where the closing quote is.)
Actually, it should be
$sql = "INSERT INTO userInfo (email, firstname, lastname)
VALUES (?, ?, ?)";
and then you can use it as a prepared statement:
$stmt = $conn->prepare($query);
$stmt->bind_param('sss', $EM, $FN, $LN);
$stmt->execute();

Answer 3

The reason why you're seeing that specific error is because on line 32, you're incorrectly calling the close method of your conn class:
$conn-close();
This is missing the closing angle bracket, and should be:
$conn->close();
After you fix this error, you will then most likely see an error for the incorrect SQL formatting as pointed out in the other answers. This will most likely be a function not defined error, as you probably don't have a function called VALUE($a, $b, $c) somewhere.

Answer 4

You have two issues in query
extra double quotes between columns and values.
not using single quotes between string values.
Modified query:
$sql = "INSERT INTO userInfo (email, firstname, lastname) VALUES ('$EM', '$FN', '$LN')";
Side note:
Also check the close function as mentioned in other answer correct your typo error.

Answer 5

The displayed error can be corrected as follows:
$sql = "INSERT INTO userInfo (email, firstname, lastname) VALUES ($EM, $FN, $LN)";
Also please correct the last line as follows:
$conn->close();