Trying to INSERT data to table via PHP and MySQL. What can cause the syntax problem?

Question

When I try to INSERT data into my "appointments" table using "postAppointment" function it gives an error. When I try this by writing the function's code on my own it works propperly.

The Error:

Fatal error: Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '@elo.com, 3 , 2023-05-08, 09:00)' at line 1 in C:\xampp\htdocs\HealthBoyz\models\doctors.php:27 Stack trace: #0 C:\xampp\htdocs\HealthBoyz\models\doctors.php(27): mysqli_query(Object(mysqli), 'INSERT INTO app...') #1 C:\xampp\htdocs\HealthBoyz\index.php(20): Doctors->postAppointment('HWDP', 'JOTPE', 'elo@elo.com', 3, '2023-05-08', '09:00') #2 {main} thrown in C:\xampp\htdocs\HealthBoyz\models\doctors.php on line 27

// GIVES AN ERROR
<?php 
    include("./dbconfig.php");
    include("./dbconnection.php"); 
    include("./models/doctors.php");

    $db = (new DB($db_config))->getConnection();

    if (isset($_SERVER['HTTP_ORIGIN'])) {
        header("Access-Control-Allow-Origin: *");
        header("Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE, OPTIONS");
        header("Access-Control-Allow-Headers: Origin, Authorization, X-Requested-With, Content-Type, Accept");
        header('Access-Control-Allow-Credentials: true');
        header('Access-Control-Max-Age: 86400');    
    }
    
    $method = $_SERVER['REQUEST_METHOD'];

    $doctors = new Doctors($db);

    $query = $doctors->postAppointment('JOTPE','YO', 'elo@elo.com', 3, '2023-05-08', '09:00');
?>

// WORKS PROPPERLY
<?php 
    include("./dbconfig.php");
    include("./dbconnection.php"); 
    include("./models/doctors.php");

    $db = (new DB($db_config))->getConnection();

    if (isset($_SERVER['HTTP_ORIGIN'])) {
        header("Access-Control-Allow-Origin: *");
        header("Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE, OPTIONS");
        header("Access-Control-Allow-Headers: Origin, Authorization, X-Requested-With, Content-Type, Accept");
        header('Access-Control-Allow-Credentials: true');
        header('Access-Control-Max-Age: 86400');    
    }

    $method = $_SERVER['REQUEST_METHOD'];

    $doctors = new Doctors($db);

    $query = "INSERT INTO appointments (name, last_name, e_mail, doctor_id, date, time) VALUES ('JOTPE','YO', 'elo@elo.com', 3, '2023-05-08', '09:00')";
    $query_results = mysqli_query($db, $query);  
?>

// Docotrs model containing postAppointment function
<?php 
    class Doctors {
        private $db;

        public function __construct($dbdata) { 
            $this->db = $dbdata; 
        }


        public function getAllDoctors() {
            $query = "SELECT * FROM doctors";
            $query_results = mysqli_query($this->db, $query);

            $this->checkForQueryErrors($query, $query_results);

            $doctors = array();

            while($row = $query_results->fetch_assoc()) {
                array_push($doctors, array("id" => $row["id"], "name" => $row["name"], "imgUrl" => $row["img_url"], "description" => $row["description"]));
            }

            return $doctors;
        }

        public function postAppointment($name, $last_name, $e_mail, $doctor_id, $date, $time) {
            $query = "INSERT INTO appointments (name, last_name, e_mail, doctor_id, date, time) VALUES ($name, $last_name, $e_mail,  $doctor_id , $date, $time)";
            $query_results = mysqli_query($this->db, $query);

            $this->checkForQueryErrors($query, $query_results);

            return $query_results;
        }



        private function checkForQueryErrors($query, $query_results) {
            if (!$query_results) {
              throw new Exception("Error executing query: " . $query . "\nErrno: " . $this->db->errno . "\nError: " . $this->db->error . "\n");
            }
          }

    }
?>

Have anyone had similar problem and know how to solve it?

The method you are trying to use creates a string that needs to match SQL syntax including single quotes around string values as in your working example. That is tricky to get right and vulnerable to injection attack, so you should use bound paramaters as @Olivier suggested. — bitfiddler, Aug 06 '23 at 15:01

Trying to INSERT data to table via PHP and MySQL. What can cause the syntax problem?

0 Answers0