PDO Error with MySQL query [duplicate] - php

Question

This question already has an answer here:
Syntax error due to using a reserved word as a table or column name in MySQL
(1 answer)
Closed 8 years ago.
I have been staring at the below code for over an hour any cannot see any issues.
public function add($data){
$sql = 'INSERT INTO ' . $this->name . '(fbid, userAccessToken, name, location, story, gender, email, email_md5, referrer, date, use, optin) VALUES (:fbid, :userAccessToken, :name, :location, :story, :gender, :email, :email_md5, :referrer, :date, :use, :optin)';
$mysqldate = date('Y-m-d G:i:s');
$result = $this->dbh->prepare($sql);
if($result->execute(array(
':fbid' => $data['fbid'],
':userAccessToken' => $data['userAccessToken'],
':name' => $data['name'],
':location' => $data['location'],
':story' => $data['story'],
':gender' => $data['gender'],
':email' => $data['email'],
':email_md5' => md5($data['email']),
':referrer' => $data['referrer'],
':date' => $mysqldate,
':use' => $data['use'],
':optin' => $data['optin']
))){
$return = $this->dbh->lastInsertId();
}
}
The error is
PHP Warning: PDOStatement::execute() [pdostatement.execute]:
SQLSTATE[42000]: Syntax error or access violation: 1064 You have an
error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near 'use, optin)
VALUES ('517371547', 'no-auth', 'Shane Jones', 'Manchest' at line 1

Answer 1

USE is a reserved word in mySQL.
You need to put it in backticks, or use a different column name.

Answer 2

use is a keyword in MySQL. If you want to use it as a column identifier, enclose it in backticks:
$sql = 'INSERT INTO `' . $this->name . '` ( `fbid`, `userAccessToken`, `name`, `location`, `story`, `gender`, `email`, `email_md5`, `referrer`, `date`, `use`, `optin`) VALUES (:fbid, :userAccessToken, :name, :location, :story, :gender, :email, :email_md5, :referrer, :date, :use, :optin)';
Anyway you should always enclose all identifiers in backticks, to prevent such errors!

Answer 3

USE is a reserved keyword that must be enclosed with backticks ` (see documentation).

Answer 4

Your problem comes from the fact that you are building your query manually.
While with whatever sane database abstraction library which will take the duty of building syntactically correct queries for you, the code become as small as few short lines:
public function add($data){
global $db;
$data['date'] = date('Y-m-d G:i:s');
$db->query('INSERT INTO ?n SET ?u',$this->name,$data);
return $db->insertId();
}
and raise no error on any of nearly hundred reserved words even if you know none of them.