in query Whats the error pls solve it - php

Question

i have the following error
insert into staff_service(customer_id,workorder_no,service_date,current_date) values('1','414','2011-03-14',CURDATE()) 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'current_date) values('1','414','2011-03-14',CURDATE())' at line 1
<?php
session_start();
include "common/config.php";
$file=file("Template/staffservice_management.html");
$filecontent=join("",$file);
include("user.php");
/*$sql = "SELECT id,customer_name FROM customer "."ORDER BY customer_name";
$rs = mysql_query($sql);
while($row = mysql_fetch_array($rs))
{
echo "<option value=\"".$row['id']."\">".$row['customer_name']."</option>";
echo "<option value=\"".$row['id']."\">".$row['customer_name']."</option>";
echo "<option value=\"".$row['id']."\">".$row['customer_name']."</option>";
}*/
$sql="select * from customer";
$res=mysql_query($sql);
while($row=mysql_fetch_array($res))
{
$list_option.="<option value='".$row['id']."'>".$row['customer_name']."</option>";
}
$cust=$_POST['cname'];
$work=$_POST['won'];
$date=$_POST['startdate'];
if($_REQUEST['submit']=='submit')
{
$sqle=("insert into staff_service(customer_id,workorder_no,service_date,current_date) values('$cust','$work','$date',CURDATE())");
$Insertprocess=$db->insert_data_id($sqle);
echo "<script>alert(' Details Successfully created');</script>;";
echo "<script>location.href='staffservice_management.php';</script>;";
}
$filecontent=preg_replace("/{{(.*?)}}/e","$$1",$filecontent);
echo $filecontent;
?>

Answer 1

Don't interpolate variables straight into your SQL, you're asking for SQL injection attacks. Take a look at http://www.bobby-tables.com/
As for the error, there's no space after the table name, that's the likely culprit; it's being treated as a call to an unknown function, staff_service().

Answer 2

insert into staff_service (customer_id,workorder_no,service_date,current_date) values('$cust','$work','$date',CURDATE())
leave space after table name

Answer 3

I guess you need an space between
staff_service
and
(customer_id,workorder_no,service_date,current_date)
Try with:
$sqle=("insert into staff_service (customer_id,workorder_no,service_date,current_date) values('$cust','$work','$date',CURDATE())");
HTH!

Answer 4

INSERT INTO staff_service
(customer_id,workorder_no,service_date,current_date)
VALUES ('1','414','2011-03-14',CURDATE())
There are a couple of questions about Data Types:
What is the data type of customer_id?
if it is a INT data type, no need for the single quotes around the value 1
EXAMPLE: VALUES (1,'414','2011-03-14',CURDATE())
What is the data type of workorder_no?
if it is a INT data type, no need for the single quotes around the value 414
EXAMPLE: VALUES ('1',414,'2011-03-14',CURDATE())
What is the data type of service_date?
If it's a date/time type are you submitting the correct format?
Other formats
What is the data type of current_date?
If it's a date/time type are you submitting the correct format?
Other formats
You might want to end you SQL statement with a semicolon as well, like this:
INSERT INTO staff_service
(customer_id,workorder_no,service_date,current_date)
VALUES ('1','414','2011-03-14',CURDATE());
My suggestions are to make sure you are passing the data in the correct format

Answer 5

You do not need to use " ' " for numbers/ids:
insert into staff_service(customer_id,workorder_no, service_date,current_date) values(1,414,'2011-03-14',CURDATE())

Answer 6

Add a semicolon at the end of the SQL query.