Syntax Error unexpected T_STRING

Question

I am trying to create a form that inputs data to my database however I am getting a syntax error unexpected T_String on line 56. The line in question is my SQL Insert statement but I can't find my error. My code is included below and any help would really be appreciated.

        foreach ($postNameArr as $postName){
        if (array_key_exists($postName, $_POST)){
            $w = "INSERT INTO tblContent('PageHeading', 'SubHeading', 'Content', 'PageTitle', 'MetaDescription', 'MetaKeywords') VALUES (["ph"],["sh"],["pc"],["pt"],["md"],["mk"])";
            //if it works...
            if ($conn->query($w) === TRUE) {
                echo "New record created successfully";
            }
            //error handling
         else {
            echo "Error: " . $w . "<br>" . $conn->error."');";
        }

        $conn->close();
    }
}

The code highlighter in the question itself shows there are strings that shouldn't be there. You need to escape your quotes `\"` or change then double quotes inside your `VALUES` to single quotes. — Jay Blanchard, Apr 29 '15 at 19:57
Why do you have the values inside square brackets? MySQL doesn't use that syntax in its queries. — Barmar, Apr 29 '15 at 19:58
Did you mean to write `$_POST["ph"]` instead of just `["ph"]`? — Barmar, Apr 29 '15 at 19:59
You are mixing double and single quotes in the insert statement without escaping the additional double quotes. You should wrap your db values with single quotes. — Crackertastic, Apr 29 '15 at 20:02
What exactly do you think `"...VALUES (["ph"],["sh"],["pc"],["pt"],["md"],["mk"])";` does? — Sverri M. Olsen, Apr 29 '15 at 20:09

Barmar · Accepted Answer · 2015-04-29T20:07:34.543

The quotes in your VALUES clause are ending the string literal. However, rather than showing how to fix that, the best way to do this is using a prepared query.

$stmt = $conn->prepare("INSERT INTO tblContent(`PageHeading`, `SubHeading`, `Content`, `PageTitle`, `MetaDescription`, `MetaKeywords`) VALUES (?, ?, ?, ?, ?, ?)";
$stmt->bind_param("ssssss", $_POST["ph"],$_POST["sh"],$_POST["pc"],$_POST["pt"],$_POST["md"],$_POST["mk"]);
$stmt->execute();

Also, the quotes that should go around table and column names are backticks, not single or double quotes -- those make string literals. But you don't usually need them at all, you only need them when the name conflicts with a MySQL reserved word or contains special characters.

score -1 · Answer 2 · answered Apr 29 '15 at 20:07

i did not understant this part

         (["ph"],["sh"],["pc"],["pt"],["md"],["mk"])

if ph,sh,pc are define you should write in double quotes.

        (".ph.",".sh."...)

you must put php verable in quotes. if your start with singel quotes you should put php variable in singel quotes for example

    $gettest="hello booboo !";
    $singel= ' i start with single quoes  so i put my variable in singel quotes '.$gettest.' ';
    $double= " i start with double quoes  so i put my variable in double quotes ".$gettest." ";

echo $singel."<br>";
echo $double."<br>";

Syntax Error unexpected T_STRING

2 Answers2