Insert multiple rows in sql

Question

Can someone tell me why this query is wrong?

$tbl_name = "Attributes";
$pieces = //some array 
//other variables... blah blah blah

$query = "INSERT INTO $tbl_name (Word, What, When) VALUES";
foreach($pieces as $word){
    $query .= "('$word', '$What', '$When'),";
}

$query = substr($query, 0, -1);  //to remove the last comma

mysql_query($query) or die(mysql_error());

If you can tell, I am trying to insert multiple rows with a single query. When I try and run it, I get hit with a syntax error, but I am 99.9999% sure there are no spelling mistakes. Am I doing something wrong by trying to insert multiple rows at once like this?

Answer 1

when is a reserved word either wrap it in `` or use another. List of MySQL reserved words: http://dev.mysql.com/doc/refman/5.5/en/reserved-words.html

Answer 2

is it possible that at some point in your $word,$what,$when you have a ' that is unsacaped ? or some mysql injection ?

if yes i would try using mysql_real_escape_string http://php.net/manual/en/function.mysql-real-escape-string.php