php-错误的sql语法

Question

I am trying to insert form data into one of the tables in my database. Data to be inserted are name, email, current date and users interests. Here is the code.

if (isset($_POST['name'])) {
   $name = $_POST['name'];
   $email = $_POST['email'];
   $intrests = $_POST['intrests'];
   $default_intrests = array("mob","pcs","scm","oth");
   $interests = "";
   if (count($intrests) == 0) {
      $interests = implode(",", $default_intrests);
   }
   else {
          $interests = implode(",", $intrests);
   }

   $sqll="insert into subscriptions (name,email,subdate,intrests) values ($name,$email,CURRENT_DATE, $interests)";
   $insert = mysqli_query($link, $sqll);
   if (!$insert) {
      echo mysqli_error($link);
   }
}

On form submit, the following error is displayed:

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'dsa,[e-mail],CURRENT_DATE, mob)' at line 1

Answer 1

Add ' to the value since some of them are string

 $sqll="insert into subscriptions (name,email,subdate,intrests)
     values ('$name','$email',CURRENT_DATE, '$interests')";

In fact,it's a bad idea to write parameter into to your sql directly,you had better to use prepared-statements to do it and avoid SQL Injection