不能让这个MySQL查询工作

Question

Got this query:

mysql_query("INSERT INTO leaderboard (user_id, lines) 
    VALUES (". $rowUser['id'] .",". $linesDone .")") or die("ERROR 29: ". mysql_error());

Giving this error:

ERROR 29: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'lines) VALUES (1,50)' at line 1

I've tried all kind of syntaxing, like using ´´ and '' in the query, but all resulting in approx. the same error.

Can anyone see what is wrong?

Answer 1

Lines is a reserved word in MySQL - you have to escape this word with backticks

mysql_query("INSERT INTO leaderboard (user_id, `lines`) 
VALUES (". $rowUser['id'] .",". $linesDone .")") or die("ERROR 29: ". mysql_error());

btw.. mysql_* is deprecated as mentioned in the manual . Better use mysqli_* or pdo

Answer 2

Secure your query.

mysql_query(
         sprintf("INSERT INTO leaderboard (user_id,`lines`) 
                  VALUES ('%d','%s')",
        mysql_real_escape_string($rowUser['id']),
        mysql_real_escape_string($linesDone)
) or die("ERROR 29: ". mysql_error());