第一个PDO语法有效，第二个类似的PDO语法无效

Question

I'm trying to create two databases after people fill out a signup form with their username, password, and email.

The first MySQL query below works. It inserts their info in the user table.

The second query doesn't though. It's trying to insert an encrypted key in the confirm table that I can use to confirm their account with a confirmation email.

Here's the PDO exception message:

exception 'PDOException' with message 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'key, email) VALUES ( '24', 'd96e77df9072c73da2612380a784f51b', 'r' at line 1' in C:\\xampp\\htdocs\\tutorspot\\sign-up-tutors\\index.php:80 Stack trace: #0 C:\\xampp\\htdocs\\tutorspot\\sign-up-tutors\\index.php(80): PDOStatement->execute() #1 {main}

if($action['result'] != 'error'){

$password = md5($password . 'salty');

    try
    {
        $sql = 'INSERT INTO user (fullname, username, email, password, active) VALUES (
            :fullname,
            :username,
            :email,
            :password,
            0)';
        $s = $pdo->prepare($sql);
        $s->bindValue(':fullname', $_POST['fullname']);
        $s->bindValue(':username', $_POST['username']);
        $s->bindValue(':email', $_POST['email']);
        $s->bindValue(':password', $password);
        $s->execute();
        //get the new user id
        $userid = $pdo->lastInsertId();
    }
    catch (PDOException $e)
    {
        $error = 'Error inserting signup info.';
        include $_SERVER['DOCUMENT_ROOT'] . '/tutorspot/inc/error.html.php';
        exit();
    }

    //create a random key for confirmation
    $key = $username . $email . date('mY');
    $key = md5($key . 'salty');

    //add info to confirm table

    try
    {   
        $sql = 'INSERT INTO confirm (userid, key, email) VALUES (
            :userid,
            :key,
            :email)';
        $s = $pdo->prepare($sql);
        $s->bindValue(':userid', $userid);
        $s->bindValue(':key', $key);
        $s->bindValue(':email', $_POST['email']);
        $s->execute();
    }
    catch (PDOException $e)
    {
        $error = 'Error inserting confirm info.';
        include $_SERVER['DOCUMENT_ROOT'] . '/tutorspot/inc/error.html.php';
        echo $e;
        exit();
    }
}

Answer 1

key and user are reserved words in SQL syntax. Wrap your columns and table names in backticks. For example:

(`userid`, `key`, `email`)