将字母数字值插入varchar类型列

Question

Hi i am trying to insert a alphanumeric value 46e0d48d-bca1-11e7-991f-2c27d70ced1d into an varchar type column in a table. I am inserting through a variable but getting 1604 error that is syntax is not right. Here is the code

    SET @sql = CONCAT('insert into ', @user_table_name, ' 
                    (user, user2, message, mesg_type, date_time, mesg_read_status)
                    values (',@user_id,',',@user2_id,',',@message,',',@mesg_type,',',@date_time,',',@read_status,')'
                   );
select @sql;    
PREPARE stmt FROM @sql;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;

For user column i am passing the alphanumeric value 46e0d48d-bca1-11e7-991f-2c27d70ced1d .

Answer 1

Learn to use parameters:

SET @sql = CONCAT('
insert into ', @user_table_name, ' (user, user2, message, mesg_type, date_time, mesg_read_status)
    values (?, ?, ?, ?, ?, ?)
                  ');

PREPARE stmt FROM @sql;
EXECUTE stmt USING @user_id, @user2_id, @message, @mesg_type, @date_time, @read_status;

DEALLOCATE PREPARE stmt;

Don't munge query strings with parameter values. That makes the code harder to debug, prone to errors, more difficult to read, and opens another line of attack for SQL injection.

Answer 2

 SET @sql = CONCAT('insert into ', @user_table_name, ' 
                (user, user2, message, mesg_type, date_time, mesg_read_status)
                values (\'',@user_id,'\',',@user2_id,',',@message,',',@mesg_type,',',@date_time,',',@read_status,')'
               );
select @sql;    
PREPARE stmt FROM @sql;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;

This statement should work. Give it a try