Error in SQL syntax when inserting new record to MySql

Question

With this query I get an error "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near..."

$sql = 'INSERT INTO articles (  long_text )
        VALUES ("' . mysqli_real_escape_string($conn, $long) . '")';

        if ($conn->query($sql) === TRUE) {
            echo "New record created successfully" . "<br>" ;
        } else {
            echo "Error: " . $sql . "<br>" . $conn->error;
        }

Does anyone know what is causing the problem?

Answer 1

Quotes problem in your query. You are tring to write double quotes inside single quotes.

You need to change your query as prepare statement as

$stmt = $conn->prepare("INSERT INTO articles (`long_text`) VALUES (?)");
$stmt->bind_param('s', $long);
/* execute prepared statement */
$stmt->execute();

printf("%d Row inserted.\n", $stmt->affected_rows);

/* close statement and connection */
$stmt->close();

Read http://php.net/manual/en/mysqli-stmt.bind-param.php