PHP to insert into a database error [closed] - php

Question

Closed. This question is not reproducible or was caused by typos. It is not currently accepting answers.
This question was caused by a typo or a problem that can no longer be reproduced. While similar questions may be on-topic here, this one was resolved in a way less likely to help future readers.
Closed 8 years ago.
Improve this question
So, I am trying to debug a program of mine, It is a simple PHP code for inserting into a database.
Whenever I run this in my browser :
http://localhost:3456/maps/savemdata.php?descr=Best&lat=-37.12345&lng=122.12345
It should Insert the values into the DB, but what I get is :
Invalid query: You have an error in your SQL syntax; check the manual
that corresponds to your MySQL server version for the right syntax to
use near 'desc, lat, lng ) VALUES ('Best', '-37.12345', '122.12345' )'
at line 1
Savemdata.php
<?php
$hostname = '127.0.0.1:3306';
$dbname = 'login'; // Your database name.
$username = 'root'; // Your database username.
$password = ''; // Your database password. If your database has no password, leave it empty.
mysql_connect($hostname, $username, $password) or DIE('Connection to host is failed, perhaps the service is down!');
mysql_select_db($dbname) or DIE('Database name is not available!');
// Gets data from URL parameters
$desc = $_GET['descr'];
$lat = $_GET['lat'];
$lng = $_GET['lng'];
// Insert new row with user data
$query = sprintf("INSERT INTO markers " .
" (desc, lat, lng ) " .
" VALUES ('%s', '%s', '%s' );",
mysql_real_escape_string($desc),
mysql_real_escape_string($lat),
mysql_real_escape_string($lng));
$result = mysql_query($query);
if (!$result) {
die('Invalid query: ' . mysql_error());
}
?>

Answer 1

DESC is a keyword in mysql. You should take it in backticks ;)

Answer 2

desc is a reserved keyword and happens to be the name of your column. To avoid syntax error, you need to escape it using backtick. eg,
$query = sprintf("INSERT INTO `markers` " .
" (`desc`, `lat`, `lng` ) " .
" VALUES ('%s', '%s', '%s' );",
mysql_real_escape_string($desc),
mysql_real_escape_string($lat),
mysql_real_escape_string($lng));
MySQL Reserved Keywords List
If you have the privilege to alter the table, change the column name to which is not a reserved keyword to avoid problem from occurring again.

Answer 3

Rahul, i would suggest you to use PDO. Try changing your code in the below way.
<?php
$hostname = '127.0.0.1:3306';
$dbname = 'login'; // Your database name.
$username = 'root'; // Your database username.
$password = '';
// database connection
$conn = new PDO("mysql:host=$hostname;dbname=$dbname",$username,$password);
// new data
$desc = $_GET['descr'];
$lat = $_GET['lat'];
$lng = $_GET['lng'];
// query
$sql = "INSERT INTO markers (desc,lat,lng) VALUES (:desc,:lat,:lng)";
$q = $conn->prepare($sql);
$q->execute(array(':desc'=>$desc,
':lat'=>$lat,
':lng'=>$lng));
?>