如何更正此PHP语法

Question

I created a Form with inputs named name, and msg;

I have:

$q /* My SQL query */ = "INSERT INTO posts ('NOW(),$_POST['name'],$_POST['msg']')";

in my PHP; after deploying the file I get a 500 error.

I know this code is bugged because after taking it out the page loads fine. How do I fix it, I'm guessing its to do with quotation marks?

I think I could concatenate the posted data - using periods - instead of inputting straight into the string, but isn't it possible to do it in the cleaner, nicer, way?

Answer 1

The issue does have to do with quotes. Here is a way to fix it:

$q = "INSERT INTO posts (NOW(), '{$_POST['name']}', '{$_POST['msg']}')";

Note that it is extremely important to use prepared statements when dealing with user input to prevent SQL injections.

The PHP manual includes a great page on prepared statements .