带有电子邮件的 MySQL 语法错误

Question

I am trying to get POST'ed form variables and mySQL is throwing an error when trying to insert them. I can't figure for the life of me why. Hopefully someone can help out.

    function submitFound(){
    global $dbc;
    if ($_SERVER['REQUEST_METHOD'] == 'POST'){

        $query = 
        "INSERT INTO found1 
        (fname, lname, email, phone, name, color, make, model, sizes, info, location) 
        VALUES
        (" . 
        mysql_real_escape_string($_POST['fname']) . ","  . 
        mysql_real_escape_string($_POST['lname']) . ","  . 
        mysql_real_escape_string($_POST['email']) . "," . 
        mysql_real_escape_string($_POST['phone']) . ","  . 
        mysql_real_escape_string($_POST['name'])  . ","   . 
        mysql_real_escape_string($_POST['color']) . ","  . 
        mysql_real_escape_string($_POST['make'])  . ","   . 
        mysql_real_escape_string($_POST['model']) . ","  . 
        mysql_real_escape_string($_POST['size'])  . ","   . 
        mysql_real_escape_string($_POST['info'])  . ","   . 
        mysql_real_escape_string($_POST['location']). ")";
        $results = mysqli_query($dbc, $query);
        check_results($results);
        //return $mysqli_insert_id($dbc);
        mysqli_free_result($results);
    }
}

That is the function that is submitting the information. (Generic information about an item. This is the mySQL error getting thrown.

MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '@gmail.com,444-444-4444,Book,#000040,NA,NA,Large,Nothing special,Byrne House)' at line 4

This is what I input in the form. http://puu.sh/8l35Z.png

So yeah, any help would be great. Not sure if it is just something stupid. My eyes are starting to cross :P

Thanks in advance.

EDIT* Fixed the Strings but am still getting an error: New Code:

            $query = 
        "INSERT INTO found1 
        (fname, lname, email, phone, name, color, make, model, sizes, info, location) 
        VALUES
        ('" . 
        mysql_real_escape_string($_POST['fname']) . "','"  . 
        mysql_real_escape_string($_POST['lname']) . "','"  . 
        mysql_real_escape_string($_POST['email']) . "','" . 
        mysql_real_escape_string($_POST['phone']) . "','"  . 
        mysql_real_escape_string($_POST['name'])  . "','"   . 
        mysql_real_escape_string($_POST['color']) . "','"  . 
        mysql_real_escape_string($_POST['make'])  . "','"   . 
        mysql_real_escape_string($_POST['model']) . "','"  . 
        mysql_real_escape_string($_POST['size'])  . "','"   . 
        mysql_real_escape_string($_POST['info'])  . "','"   . 
        mysql_real_escape_string($_POST['location']). "')'";

MySQL error: MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 4 MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 4

Answer 1

As John Conde mentioned, you need to add quotes around your values, your error message shows this.

@gmail.com,444-444-4444,Book,#000040,NA,NA

Notice the missing quotes, it should look like this

'@gmail.com','444-444-4444','Book','#000040','NA','NA'

Try this

VALUES
        ('" . 
        mysql_real_escape_string($_POST['fname']) . "','"  . 
        mysql_real_escape_string($_POST['lname']) . "','"  . 
        mysql_real_escape_string($_POST['email']) . "','" .