只有数字插入sql中

Question

So i have this form

<form>Tag name:
    <input type='text' name='tagname' />
    <input type='submit' value='Add' />
    <input type='hidden' name='id' value='$id' />
</form>
<hr />

it runs this script

if ($tagname) 
{   
    mysql_query("INSERT INTO tags (id, tag) VALUES ($id, $tagname)");
    ?>
    <script type="text/javascript">
    alert("Tag added.");
    history.back();
    </script>
    <?php
}   

If i insert numbers in form it gets added to sql database nicely,but if it consist of alphabetical characters i get the alert but nothing is inserted in database. I checked phpmyadmin if the structure is wrong(text/varchar/int...) tried most of them but it is the same.

Answer 1

You need single quotes to enclose strings within SQL queries:

 mysql_query("INSERT INTO tags (id, tag) VALUES ('$id', '$tagname')");

And I'm conjecturing you also forgot to apply mysql_real_escape_string beforehand.