query failed when upload pdf file to mysql via php - php

Question

I am trying to do a upload button which able to upload a pdf file to database but it faced some problems. database i used mySQL.
pop out window for user to key in document
<form method="POST" action="upload.php" enctype="multipart/form-data">
<div>
<label for="citation">Citation</label>
<textarea name="citation" id="citation" placeholder="Enter text here..."></textarea>
</div>
<div>
<label for="abstract">Abstract</label>
<textarea name="abstract" id="abstract" placeholder="Enter text here..."></textarea>
</div>
<p>Upload your file here</p>
<input type="hidden" name="MAX_FILE_SIZE" value="2000000">
<input name="userfile" type="file" id="userfile">
<br/>
<input name="submit" type="submit" value="Upload" style="width: 150px">
<a class="close" href="#close"></a>
</form>
this is upload.php
<?php
// Connect to the database
$host="localhost"; // Host name
$username="root"; // Mysql username
$password=""; // Mysql password
$db_name="is"; // Database name
$tbl_name="publication"; // Table name
$conn = mysql_connect("$host", "$username", "$password");
if(! $conn )
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db($db_name);
$cit=mysql_real_escape_string($_POST['citation']);
$abs=mysql_real_escape_string($_POST['abstract']);
if(isset($_POST['submit']) && $_FILES['userfile']['size'] > 0)
{
$fileName = $_FILES['userfile']['name'];
$tmpName = $_FILES['userfile']['tmp_name'];
$fileSize = $_FILES['userfile']['size'];
$fileType = $_FILES['userfile']['type'];
$fp = fopen($tmpName, 'r');
$content = fread($fp, filesize($tmpName));
$content = addslashes($content);
fclose($fp);
if(!get_magic_quotes_gpc())
{
$fileName = addslashes($fileName);
}
$query = "INSERT INTO publication ('citation','abstract','file_name', 'file_size', 'file_type', 'file_content' ) VALUES ('$cit','$abs','$fileName', '$fileSize', '$fileType', '$content')";
mysql_query($query) or die('Error, query failed');
echo "<script type='text/javascript'>alert('File $fileName uploaded!');
window.location.href='home_unlogin.php';
</script>";
}
mysql_close($conn);
?>
at the next it show error, query failed and i have no idea whats wrong with it.

Answer 1

$query = "INSERT INTO publication (`citation`,`abstract`,`file_name`, `file_size`, `file_type`, `file_content`) VALUES ('$cit','$abs','$fileName', '$fileSize', '$fileType', '$content')";
or you can use without wrapping field names
$query = "INSERT INTO publication (citation, abstract, file_name, file_size, file_type, file_content) VALUES ('$cit','$abs','$fileName', '$fileSize', '$fileType', '$content')";
Because your field names are standard names which are not reserved word or contains special chars.

Answer 2

For the fields in SQL you can leave it without quotations but for the values it should be inside a quotations whether it is variable or static.
$select = "INSERT INTO tbl_table (tbl_field1,tbl_field2) VALUES ('$value1','Test')";