SQL语法错误，有人可以帮我申请表格吗？

Question

I have searched in the web and this site for weeks looking for an answer as to why my PHP code isn't working, but I haven't found out yet.

I'm making a form on my website where users can signup for an event. Those data will then be stored in a MySQL database.

This is my PHP code of process.php:

<?php
$connect=mysqli_connect('hostxxxx','userxxxx','passwordxxxx','databasexxxx');

if(mysqli_connect_errno($connect))
{
        echo 'Failed to connect';
}

// create a variable
$name=$_POST['name'];
$club=$_POST['club'];
$food=$_POST['food'];
$when=$_POST['when'];
$acro=$_POST['acro'];

//Execute the query

mysqli_query($connect,"INSERT INTO registered (name,club,food,when,acro)
                VALUES('$name','$club','$food','$when','$acro')");


if(mysqli_affected_rows($connect) > 0){
    echo "<p>Signup successful!<br>The JWDW-crew</p>";
    echo "<a href='index.html'>Go Back</a>";
} else {
    echo "Signup failed";
    echo mysqli_error ($connect);
}

?>

My MySQL database contains 5 rows: name, club, food, when and acro . I have made a form in my index.html file, which starts with:

<form method="post" action="process.php"

I really can't figure out what's wrong with it. I keep getting the error message:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'when,acro) VALUES('','','Yes','Only in the day','Yes')' at line 1

Can someone help with my code?

Answer 1

Let's escape your column names with an ` character.

mysqli_query($connect,"INSERT INTO registered (`name`,`club`,`food`,`when`,`acro`) VALUES('$name','$club','$food','$when','$acro')");

as Strawberry sad in his comment.

• Avoid sql injections by escaping your variables what comes from user input.