phpmysql inserts blank instead of value - php

Question

I have the following function:
function insert($database, $table, $data_array)
{
# Connect to MySQL server and select database
$mysql_connect = connect_to_database();
mysql_select_db ($database, $mysql_connect);
# Create column and data values for SQL command
foreach ($data_array as $key => $value)
{
$tmp_col[] = $key;
$tmp_dat[] = "'$value'";
}
$columns = join(",", $tmp_col);
$data = join(",", $tmp_dat);
# Create and execute SQL command
$sql = "INSERT INTO ".$table."(".$columns.")VALUES(". $data.");";
$result = mysql_query($sql, $mysql_connect);
# Report SQL error, if one occured, otherwise return result
if(mysql_error($mysql_connect))
{
echo "MySQL Update Error: ".mysql_error($mysql_connect);
$result = "";
}
else
{
return $result;
}
}
The values in php are the following:
$content_table = "p_content";
$insert_array['title'] = $title;
$insert_array['content'] = $content;
$insert_array['url'] = $get_source;
$insert_array['video'] = $video;
$insert_array['date'] = $date;
insert(DATABASE, $content_table, $insert_array);
The result of all this adds a row with id (key, autoimcrement), url, and date. Title, content and video are blank. If I echo title I get the correct result, if i var_dump the title I get string(15)"blablablabla", again correct.
Now if I hand set the $title = "asdf"; it is getting inserted correctly. Same goes for content and video.
table structure
id int(8) unsigned NO PRI NULL auto_increment
title varchar(1000) YES NULL
content longtext YES NULL
video varchar(3000) YES NULL
url varchar(300) YES NULL
date date YES NULL

Answer 1

Try adding quotes to your variables. :-) The reason is that you MYSQL column types are set as VARCHAR. And inserting data requires that you surround your inserts with quotes.
B.T.W. if this is new code I would recommend to switch to the MYSQLI or PDO library.

Answer 2

Try:
function insert($database, $table, $data_array)
{
# Connect to MySQL server and select database
$mysql_connect = connect_to_database();
mysql_select_db($database, $mysql_connect);
$cols = array();
$vals = array();
foreach ($data_array as $key => $value) {
$cols[] = "`" . $key . "`";
if (is_int($value) || is_float($value)) {
$vals[] = $value;
} else {
$vals[] = "'" . mysql_real_escape_string($value) . "'";
}
}
$sql = "INSERT INTO " . $table
. ' (' . implode(', ', $cols) . ') '
. 'VALUES (' . implode(', ', $vals) . ')';
$result = mysql_query($sql, $mysql_connect);
# Report SQL error, if one occured, otherwise return result
if(mysql_error($mysql_connect)) {
echo "MySQL Update Error: " . mysql_error($mysql_connect);
$result = ""; // FIXME should probably return false here
} else {
return $result;
}
}
IMPORTANT
Your code and the above is potentially vulnerable to SQL Injections. Go read about them.