PHP MySQL script shows no error but won't insert row - php

Question

Here's the line of my code that is supposed to insert the row:
$query=mysqli_query($con,"insert * into orders
values
( ".$user_index.",".$order_date.",
".$_POST['item_number'].",".$_POST['price'].",
".$_POST['tax'].",'".$_POST['pay_method']."')
");
My connection doesn't throw any errors ever either. Also, the line of code after it definitely executes. This is my first time using the date data type with PHP and MySQL, but I'm inserting the date in the format yyyymmdd. I'm so frustrated. I checked everywhere online. Can you please help me?

Answer 1

The main problem with your query is the *. That is invalid for an INSERT statement.
Secondly, to avoid SQL injection vulnerabilities, you should be using a prepared statement with bound parameters. You should probably also use some form of error checking. For example
$stmt = $con->prepare('INSERT INTO `orders` VALUES (?, ?, ?, ?, ?, ?)');
if ($stmt === false) {
throw new Exception($con->error);
}
$stmt->bind_param('ssssss', $user_index, $order_date, $_POST['item_number'],
$_POST['price'], $_POST['tax'], $_POST['pay_method']);
if (!$stmt->execute()) {
throw new Exception($stmt->error);
}
FYI, without knowing the data types for your columns, I've assumed they're all strings.

Answer 2

First you have to remove * from the insert query
Second if you are inserting values like this make sure no of column in table is same as no of values you are inserting here(In this case 6)

Answer 3

There is so much wrong with your query. look at the documentation for proper syntax
mysqli_query($con,"INSERT INTO table_name (field1,field2,field1) values ('value1','value2','value3')");
In Specific to your problem
$query=mysqli_query($con,"INSERT INTO orders (your fields Here ) VALUES (
'".$user_index."', '".$order_date."', '".$_POST['item_number']."',
'".$_POST['price']."', '".$_POST['tax']."', '".$_POST['pay_method']."'
)");