Stuck with unknown column in field MySQL - php

Question

I keep getting this error
Unknown column 'Hello' in 'field list'
when I execute this code
$sql = "INSERT INTO installs (date,addedBy,customer,reg,vehMake,vehModel,colour,mileage,location,tracker,serial,sim,extr as,satnav,input1,input2,output,comments) VALUES (" . $date . ", " . $addedBy . ", " . $customer . ", " . $reg . ", " . $vehMake . ", " . $vehModel . ", " . $colour . ", " . $mileage . ", " . $location . ", " . $tracker . ", " . $serial . ", " . $sim . ", " . $extras . ", " . $satnav . ", " . $input1 . ", " . $input2 . ", " . $output . ", " . $comments . ")";
$result = $connect->query($sql) or die($connect->error);

Answer 1

replace this
(' . "Hello" . ', ' . 2 . ', ' . 3 . ', ' . 4 . ', ' . 4 . ', ' . 5 . ', ' . 6 . ', ' . 7 . ', ' . 8 . ', ' . 9 . ', ' . 10 . ', ' . 11 . ', ' . 12 . ', ' . 13 . ', ' . 14 . ', ' . 15 . ', ' . 16 . ', ' . 17 . ')';
by
("Hello", 2 ,3, 4,4,5,6,7,8,9,10,11,12, 13,14,15,16,17)';
EDIT:
replace this
(" . $date . ", " . $addedBy . ",..........
by
('$date', '$addedBy',...........
or this
('" . $date . "', '" . $addedBy . "',..........

Answer 2

Hello needs to be enclosed in single quotes. Escape the quotes like this:
$sql = 'INSERT INTO installs
(date,addedBy,customer,reg,vehMake,vehModel,colour,
mileage,location,tracker,serial,sim,extras,satnav,
input1,input2,output,comments)
VALUES
(\'' . "Hello" . '\', ' . 2 . ', ' . 3 . ', ' . 4 . ', ' . 4 . ',
' . 5 . ', ' . 6 . ', ' . 7 . ', ' . 8 . ', ' . 9 . ',
' . 10 . ', ' . 11 . ', ' . 12 . ', ' . 13 . ', ' . 14 . ', ' . 15 . ',
' . 16 . ', ' . 17 . ')';

Answer 3

One likely explanation for this behavior is that sql_mode inclues (or enables) ANSI_QUOTES.
SELECT ##SESSION.sql_mode
If ANSI_QUOTES is enabled, then double quotes can't be used around string literals; whatever is between the double quotes will be interpreted as an identifier (e.g. column name). If ANSI_QUOTES is enabled, then string literals should be enclosed in single quotes.
For the love of all that is good and beautiful in this world, just use prepared statements with placeholders, to avoid issues with quotes and to thwart SQL injection vulnerabilities.
e.g.
$sql = "INSERT INTO installs (date,addedBy,customer, ...)
VALUES ( :date, :addedBy, :customer, ...)";
$sth = $connect->prepare($sql);
$sth->execute(array(':date' => $date, ':addedBy' => $addedBy, ':customer' => $customer, ... ));