php user registration form problem

Question

 <?php 
 $yourname=$_POST["yourname"]; 
 $email=$_POST["email"]; 
 $password=$_POST["password"]; 

 $country=$_POST["country"]; 

 include('includes/config.php');

 $result = mysql_query("
 INSERT INTO `ban`.`users` 
 (`userid`, 
 `email`, `password`, `yourname`, `country`)
  VALUES (NULL, '$email', '$password', '$yourname', '$country'")
   or die (mysql_error());
    ?> 

this is the page which goes after user pressing submit button in registration form. i want to insert data from form variables.what's wrong with it?

this is the error i got:--- You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 4

Answer 1

you don't have a closing bracket.

VALUES (NULL, '$email', '$password', '$yourname', '$country' ) ")

Answer 2

I think it crashes because of the missing ")" after '$country' .

 $result = mysql_query("
 INSERT INTO `ban`.`users` 
 (`userid`, 
 `email`, `password`, `yourname`, `country`)
  VALUES (NULL, '$email', '$password', '$yourname', '$country')")
   or die (mysql_error());
    ?> 

Answer 3

as a general rule I always print out my queries the first time I make it work just to be sure they're not the problem if something goes wrong.

$query = "INSERT INTO `ban`.`users` 
 (`userid`, `email`, `password`, `yourname`, `country`)
  VALUES (NULL, '{$email}', '{$password}', '{$yourname}', '{$country}')";
echo $query;
$result = mysql_query($query) or die (mysql_error());

Then you pick the output of that echo and try it in your mysql client of choice (phpmyadmin, sequel pro etc..) so you can have a quick review of eventual errors if you can't spot them yourself.

In this case the problem is the missing ")" at the end of the query.
But you also have to sanitize in some way the values you're inserting, doing an sql query directly from user data is very very very dangerous (let alone that you have to strip out single quotes "'" with addslashes().

Answer 4

Remove userid , and the NULL inserting from sql. Also use "{$password}" insead of '$password' & for the others.

Answer 5

Your SQL is all over the place. Look up how to form a correct SQL statement: http://www.w3schools.com/sql/sql_syntax.asp