使用PDO的PHP查询未插入MySQL

Question

I insert with PHP some data in my MySQL database, using PDO .

$connection->query(
    "INSERT INTO eOrderManagement.first_name (first_name)
    VALUES ('" . $firstName . "');

    INSERT INTO eOrderManagement.last_name (last_name)
    VALUES ('" . $lastName . "');

    INSERT INTO eOrderManagement.section (section)
    VALUES ('" . $section . "');

    INSERT INTO eOrderManagement.order (creation_date, wished_delivery_date, status, email, first_name_id, last_name_id, section_id)
    VALUES ('" . $creationDate . "', '" . $wishedDeliveryDate . "', 'En attente', '" . $email . "', (SELECT first_name_id FROM eOrderManagement.first_name WHERE first_name LIKE '" . $firstName . "'), (SELECT last_name_id FROM eOrderManagement.last_name WHERE last_name LIKE '" . $lastName . "'), (SELECT section_id FROM eOrderManagement.section WHERE section LIKE '" . $section . "'));

    INSERT INTO eOrderManagement.equipment (description, imputation, cost, maintenance_cost, order_id)
    VALUES ('" . $description . "', '" . $imputation . "', '" . $cost . "', '" . $maintenanceCost . "', (SELECT MAX(order_id) FROM eOrderManagement.order));"
    );

The three first requests are inserted in my database, but the two last are not. I tried to insert them manually in the MySQL Commande Line , directly with data on the query (unlike with variables in PHP), and all the query insert the data correctly.

Any idea why this two query doesn't insert anything ? The two query I am talking about are :

    INSERT INTO eOrderManagement.order (creation_date, wished_delivery_date, status, email, first_name_id, last_name_id, section_id)
    VALUES ('" . $creationDate . "', '" . $wishedDeliveryDate . "', 'En attente', '" . $email . "', (SELECT first_name_id FROM eOrderManagement.first_name WHERE first_name LIKE '" . $firstName . "'), (SELECT last_name_id FROM eOrderManagement.last_name WHERE last_name LIKE '" . $lastName . "'), (SELECT section_id FROM eOrderManagement.section WHERE section LIKE '" . $section . "'));

    INSERT INTO eOrderManagement.equipment (description, imputation, cost, maintenance_cost, order_id)
    VALUES ('" . $description . "', '" . $imputation . "', '" . $cost . "', '" . $maintenanceCost . "', (SELECT MAX(order_id) FROM eOrderManagement.order));"

Answer 1

order is a reserved word for SQL. So you have to quote your table name order

`eOrderManagement.order`

Try the following:

INSERT INTO `eOrderManagement.order` (creation_date, wished_delivery_date, status, email, first_name_id, last_name_id, section_id)
    VALUES ('" . $creationDate . "', '" . $wishedDeliveryDate . "', 'En attente', '" . $email . "', (SELECT first_name_id FROM eOrderManagement.first_name WHERE first_name LIKE '" . $firstName . "'), (SELECT last_name_id FROM eOrderManagement.last_name WHERE last_name LIKE '" . $lastName . "'), (SELECT section_id FROM eOrderManagement.section WHERE section LIKE '" . $section . "'));

    INSERT INTO eOrderManagement.equipment (description, imputation, cost, maintenance_cost, order_id)
    VALUES ('" . $description . "', '" . $imputation . "', '" . $cost . "', '" . $maintenanceCost . "', (SELECT MAX(order_id) FROM `eOrderManagement.order`));"

Moreover, your queries are vulnerable for SQL injections. So I suggest you to use prepared statements with parameters.

for example:

$query = $db->prepare('INSERT INTO eOrderManagement.equipment 
                          (description, 
                           imputation, 
                           cost, 
                           maintenance_cost, 
                           order_id) 
                   VALUES (:description, 
                           :imputation, 
                           :cost, 
                           :maintenanceCost, 
                           (SELECT MAX(order_id) FROM `eOrderManagement.order`)
                          )'
             );

$query->bindValue(':description', $description, PDO::PARAM_STR);
...

OR

$query->execute(':description' => $description, :imputation => $imputation, ...);

Another point what if there are two insert processes executed simultaneously?

 SELECT MAX(order_id) FROM `eOrderManagement.order` 

would return incorrect value. Use lastInsertId() function of PDO.

Answer 2

In fact, your problem is FAR deeper than silly syntax issue.

First of all, such a database structure makes absolutely no sense.
Having tables consists of one single field won't let you to get your data back!

So, instead of first three you have to make ONE table first, contains all your fields.

Then create ONE insert query that have to utilize prepared statements instead of interpolating variables like you do here.

And you ought to use LAST_INSERT_ID()/PDO::insertId() to handle table relations, instead of these selects.