Multidimension array causing mysql error in PHP Insert query

Question

mysql_query("INSERT INTO data(timestamp,type,lift,sets,reps,weight) VALUES(".$time.",".$_POST[type][$i].",".$_POST[lift][$i].",".$_POST[sets][$i].",".$_POST[reps][$i].",".$_POST[weight][$i].")")or die(mysql_error());

My code is as above. All the variables are set.

The error I am getting is

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Standing DB Hammer Curls,1,2,3)' at line 1

There is seemingly no reason for this.

Could someone clarifty on the problem, and ideally explain why multi dimensional arrays are so particular as far as what they need to be enclosed between etc.

Cheers

Answer 1

Are you adding ' single quotes around the variables your inserting?

This will fail

$t = "Test";
mysql_query("INSERT INTO data(mystring) VALUES (" . $t . ")");

This will work

$t = "Test";
mysql_query("INSERT INTO data(mystring) VALUES ('" . $t . "')");

Remember to defend against MySql Injection

Edit: Thanks Eric

Yes you should use something like mysql_real_escape_string() to escape the single quotes that might be in your POSTd variables.

Edit: About Injection

Briefly....because you need to wrap strings in ' (single quotes) if a ' is typed into a form and then submitted then it can break the insert or update code.

If the following is entered into a form "O'Brien" then the MySql code would be

INSERT INTO data(mystring) VALUES ('O'Brien')

Which is of course incorrect, such things can be exploited and used to gain entry to a web site. This was exploited world wide recently