My own SQL syntax error [closed] - php

Question

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.
Closed 9 years ago.
My code is.
$newModel = "INSERT INTO models (id," .
" firstname," .
" lastname," .
" email," .
" password," .
" group," .
" phone," .
" timeofday," .
" dayofweek," .
" address," .
" city," .
" state," .
" zip," .
" gender," .
" hair," .
" eye," .
" birthday," .
" birthmonth," .
" birthyear," .
" bustshirt," .
" cup," .
" waist," .
" hips," .
" waist," .
" hips," .
" weight," .
" inches," .
" dressjacket," .
" workxp," .
" twitter," .
" facebook," .
" joindate," .
" instagram," .
" imdb," .
" parentid," .
" error) VALUES (".
PrepSQL($modelid) . ", " .
PrepSQL($firstname) . ", " .
PrepSQL($lastname) . ", " .
PrepSQL($email) . ", " .
PrepSQL($password) . ", " .
PrepSQL($group) . ", " .
PrepSQL($phone) . ", " .
PrepSQL($timeofday) . ", " .
PrepSQL($dayofweek) . ", " .
PrepSQL($address) . ", " .
PrepSQL($city) . ", " .
PrepSQL($state) . ", " .
PrepSQL($zip) . ", " .
PrepSQL($gender) . ", " .
PrepSQL($hair) . ", " .
PrepSQL($eyes) . ", " .
PrepSQL($bday) . ", " .
PrepSQL($bmonth) . ", " .
PrepSQL($byear) . ", " .
PrepSQL($bust) . ", " .
PrepSQL($cup) . ", " .
PrepSQL($waist) . ", " .
PrepSQL($hips) . ", " .
PrepSQL($weight) . ", " .
PrepSQL($height) . ", " .
PrepSQL($dressjacket) . ", " .
PrepSQL($workxp) . ", " .
PrepSQL($twitter) . ", " .
PrepSQL($facebook) . ", " .
PrepSQL($joindate) . ", " .
PrepSQL($instagram) . ", " .
PrepSQL($imdb) . ", " .
PrepSQL($parentid) . ", " .
PrepSQL($error) . ")";
mysql_query($newModel) or die(mysql_error());
Its Shooting out an error:
You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use
near 'group, phone, timeofday, dayofweek, address, city, state, zip,
gender, hair, eye' at line 1

Answer 1

group is a reserved word in MySQL. You must wrap it in backticks:
`group`,
phone
etc.

Answer 2

GROUP is a reserved keyword and happens to be the name of your column. To avoid syntax error, you need to escape it using backtick. eg,
`group`
MySQL Reserved Keywords List
If you have the privilege to alter the table, change the column name to which is not a reserved keyword to avoid problem from occurring again.
As a sidenote, the query is vulnerable with SQL Injection if the value(s) of the variables came from the outside. Please take a look at the article below to learn how to prevent from it. By using PreparedStatements you can get rid of using single quotes around values.
How to prevent SQL injection in PHP?