我的SQL语句是正确的但仍然返回错误

Question

On my website I try to take a few info and add them to my database but ever since I changed the date to datetime the whole SQL statment doesn't work anymore.

I looked everywhere online and no one else seem to have the same problem I might just have missed something but the SQL statment looks correct to me.

public function addTimeLine($typeOfPost,$post,$idImage,$numberImage){
    $post = addslashes($post);
    $typeOfPost = addslashes($typeOfPost);
    $date = date("Y-m-d H:i:s");
    $query = "INSERT INTO `time_line` ( `special_note`, `type`, `id_image`, `number_image`, `dates`) VALUES ( '".$post."', '".$typeOfPost."', ".$idImage.", ".$numberImage.", '".$date."')";
    $ps = $this->_db->prepare($query);
    $ps->execute();
}

and it gives me this error

Fatal error: Uncaught PDOException: SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ' 1, '2019-07-12 16:29:58')' at line 1

Answer 1

Your not using prepared statements correctly. You need to use placeholders and then pass the values in the execute

public function addTimeLine($typeOfPost, $post, $idImage, $numberImage) {
    $date = date("Y-m-d H:i:s");
    $query = "INSERT INTO `time_line` ( `special_note`, `type`, `id_image`, `number_image`, `dates`) VALUES ( ?, ?, ?, ?, NOW())";
    $ps = $this->_db->prepare($query);
    $ps->execute([
        $post,
        $typeOfPost,
        $idImage,
        $numberImage
    ]);
}