SQL insert not saving to database [duplicate] - php

Question

This question already has answers here:
When to use single quotes, double quotes, and backticks in MySQL
(13 answers)
Closed 7 years ago.
Im having trouble getting this simple code to work, it,s part of a rating script for a product page.
$connn = new mysqli($servername, $username, $password, $dbname);
if ($connn->connect_error) {
die("Connection failed: " . $connn->connect_error);
}
$vresult1 = mysqli_query($connn,"SELECT * FROM rating_log WHERE ip=$userIP AND product_id=$pid");
if ($vresult1->num_rows > 0) {
// ERROR: user already voted
$v_msg = '<div style="color:red;">You have already voted on this product!</div>';
} else {
// enter vote
mysqli_query($connn,"UPDATE wc_products SET rating=$votecnt1");
mysqli_query($connn,"INSERT INTO rating_log (ip, product_id) VALUES ($userIP, $pid)");
$v_msg = '<div style="color:green;">Thank you for voting! DEBUG['.$userIP.'-'.$pid.']</div>';
}
$conn->close();
} // end rating
All this should do is add a new entry which logs a user ip and the id of the product, then update the product db to register the vote. The update works fine but it wont log the user.

Answer 1

Try this:
$userIP = $mysqli->real_escape_string($userIP);
$pid = $mysqli->real_escape_string($pid);
mysqli_query($connn,"INSERT INTO rating_log (ip, product_id) VALUES ('$userIP', '$pid')");
Single quotes should be used for string values like in the VALUES() list. for more details read this post answer:
When to use single quotes, double quotes, and backticks in MySQL