PHP / MySQL INSERT无法正常工作

Question

I'm really struggling with this piece pf php code where I'm wanting to insert a message into a table using data gotten from another table. Here is the code that I have:

$get_user_sql = "SELECT username FROM members WHERE id = '$member'";
$get_user_res = mysqli_query($con, $get_user_sql);
while($username = mysqli_fetch_assoc($get_user_res)){
    $user = $username["username"];
};

$get_message_sql = "SELECT message FROM posts WHERE id = '1377077348-5922'";
$get_message_res = mysqli_query($con, $get_message_sql);
while($postsmessage = mysqli_fetch_assoc($get_message_res)){
    $postmessage = $postsmessage["message"];
};

$type = "liked";
$title = "New Like";
$message = "<a href=\"profile.php?member=$user\">$user</a> just liked your post:<br /><i>$postmessage</i>";

$insert_note_sql = "INSERT INTO notes (id, sender, recipient, type, title, message, date) VALUES('$id', '$member', '$recipient', '$type', '$title', '$message', '$time')";
$insert_note_res = mysqli_query($con, $insert_note_sql);

I'm finding that if I remove $postmessage from the $message line everything works fine, but when I add it back in again the row isn't inserted. Can anyone see a reason for this?

Answer 1

You're not escaping your values, propably some of your contents include quotes or other unescaped chars.

Try using mysqli_real_escape_string :

$postmessage = mysqli_real_escape_string($postsmessage);

You should escape every value before inserting it to the database, read more about SQL Injections . Your code has potential threats.