SQL optional values breaking statement - php

Question

I am trying to do simple insert in php and MySQL.
The HTML form has 3 fields with 1st one being mandatory and other 2 optional.
their names being :
name, address and phoneno
table name is users : id(int)|name(varchar)|address(varchar)|phoneno(int) , id is primary-key and auto-increment
and all except name and id are allow-nulls
assuming i have connection created and held in $con ,providing a value just for name and submitting the form
$name = $_POST['name']?$_POST['name']:NULL;
$address= $_POST['address']?$_POST['address']:NULL;
$phoneno= $_POST['phoneno']?$_POST['phoneno']:NULL;
$q="INSERT INTO users (name,address,phoneno)
VALUES('{$name}','{$address}',{$phoneno})";
if(mysql_query($q,$con)){
echo "data inserted successfully";
}
else{
echo "ERROR: ".mysql_error();
}
Is giving me
ERROR: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ')' at line 1

Answer 1

Never do this in production environments! But for learning, try this:
$name = $_POST['name']?$_POST['name']:'NULL';
$address= $_POST['address']?$_POST['address']:'NULL';
$phoneno= $_POST['phoneno']?$_POST['phoneno']:'NULL';
$q="INSERT INTO users (name,address,phoneno) VALUES('$name','$address',$phoneno)";
if(mysql_query($q,$con)){
echo "data inserted successfully";
}
else{
echo "ERROR: ".mysql_error();
}
You have to use 'NULL' as string
Do not wrap variables with {}. this is only needed when you use object properties like {$obj->foo}
There are some other serious security issues in this code like sql injection. So never do this in production environments!