SQL insert not working

[The Red Guy]

$query = 'INSERT INTO `blogentries` VALUES (\'\', '.$_POST['title'].', '.$_POST['post'].', '.$_POST['date'].', '.$_POST['author'].', '.$_POST['mood'].')'; 

I'm trying to use the above but am unable to. How do I format the above so that I can use it? Basically I'm trying to insert values of $_POST[] into blogentries. Thanks!

[BittenApple]

Are you sure you've identified your host name and dbname dbpassword etc. etc.?

[launchcode]

It scares me more than anything when I see $_POST values inserted directly into SQL statements like this.

Validate people.. validate!

I could literally erase your SQL database contents if I wanted.

[The Red Guy]

It scares me more than anything when I see $_POST values inserted directly into SQL statements like this.

Validate people.. validate!

I could literally erase your SQL database contents if I wanted.

Erm I don't need to, I'm the only one using this script. .htaccess provides password protection.

Anyway anyone knows the syntax I should be using? I changed all of these to normal variables and they worked fine?

[launchcode]

$_POST['var'] is a standard variable (well, it's an array element, but you know what I mean).

So ultimately, if they exist and actually have data in (not that you'll know because you don't even check it.. heh ), there is no difference using them in your script the way you do at the moment than from using a standard variable. Syntax wise your code is correct.

[jaswinder_rana]

try echoing the query
echo $query
and post the result. something might be wrong with the syntax

[dacool]

Syntax wise your code is correct.

don't think so.. you should put quotes around all sting values.. something like this:

$query = '
  INSERT INTO `blogentries` VALUES (
    \'\', 
    \''.$_POST['title'].'\',
    \''.$_POST['post'].'\',
    \''.$_POST['date'].'\',
    \''.$_POST['author'].'\',
    \''.$_POST['mood'].'\'
  )'; 

[jaswinder_rana]

don't think so.. you should put quotes around all sting values.. something like this:

$query = '
  INSERT INTO `blogentries` VALUES (
    \'\', 
    \''.$_POST['title'].'\',
    \''.$_POST['post'].'\',
    \''.$_POST['date'].'\',
    \''.$_POST['author'].'\',
    \''.$_POST['mood'].'\'
  )'; 

i thought so, that's why i told to echo the query. good observation dacool

[spikeZ]

Just how I would do it...

$query = "INSERT INTO `blogentries` VALUES ( 
'".$_POST['title']. "', 
'".$_POST['post']."', 
'".$_POST['date']."', 
'".$_POST['author']."', 
'".$_POST['mood']."'
)"; 

[launchcode]

don't think so.. you should put quotes around all sting values

Yes of course.. I just saw all those quotes in his original code and figured they were around the vars, but on closer inspection it's just one giant messy string with no quotes at all. Well spotted.

[The Red Guy]

What are the things I need to lookout for, when validating the form? I'm interested to know more about it.