插入错误的SQL语法

Question

My test code is:

<?php
$connessione = mysql_connect("***", "***", "***");
mysql_select_db("***", $connessione);

$risultato = mysql_query("SELECT * FROM servem_vote", $connessione);

if(mysql_query("INSERT INTO servem_vote (uid,lastvote) VALUES ($uid,now()) ON DUPLICATE KEY UPDATE lastvote=now();

")) {
    header('location:/home.php'); }
else {
    echo "Error: " . mysql_error(); }
mysql_close($con);
?> 

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'now()) ON DUPLICATE KEY UPDATE lastvote=now()' at line 1

DB:

http://prntscr.com/ef7544

Where am I doing wrong?

Answer 1

You are missing $uid in the code you shared. You don't set that value anywhere but you attempt to use it as part of your INSERT query.

If it's coming from form data, grab it from $_REQUEST superglobal variable before attempting to use it:

$uid = $_REQUEST['uid']

If it's NOT an integer in the MySQL table, you need to wrap it in single quotes as part of your statement.

INSERT INTO servem_vote (uid,lastvote) VALUES ('$uid',now())
ON DUPLICATE KEY UPDATE lastvote=now();

I don't know what purpose this line serves:

$risultato = mysql_query("SELECT * FROM servem_vote", $connessione);

You don't seem to do anything with the result set from this query.

MOST IMPORTANTLY : As many others have commented you need to be sanitizing your data and you should be relying on PDO or mysqli* functions to safely interact with your database. See answers here