在MySql日期字段中正确插入日期

Question

I am posting data for event in this format via ajax:

doctor=100&date=2015-04-30&rCheck=1&rDate=2015-05-12&fromTime=21%3A35&toTime=22%3A40&status=open

I am getting it like this with php

$date = $_POST['date'];
$fromHours = $_POST['fromHours'];
$fromMinutes = $_POST['fromMinutes'];
$toHours = $_POST['toHours'];
$toMinutes = $_POST['toMinutes'];
$fromTime = $_POST['fromTime'];
$toTime = $_POST['toTime'];
$start = $date.' '.$fromTime.':00';
$end = $date.' '.$toTime.':00';
$status = $_POST['status'];
$doctor = $_POST['doctor'];

if($_POST['rCheck']==1){
    $repeat = $_POST['rDate'];
}else{
    $repeat = '0000-00-00';
}

When I echo any of that variables I get correct result.

I am inserting data in database like this:

$query = 'INSERT INTO events (start,end,doctor,status,repeat) VALUES ("'.$start.'","'.$end.'","'.$doctor.'","'.$status.'","'.$repeat.'")';
$result = mysqli_query($db, $query) or die (mysqli_error($db));

Now main problem is $repeat because without it everything is inserted without problem but with $repeat I get this error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'repeat) VALUES ("2015-04-30 21:35:00","2015-04-30 22:40:00","100","offen","2015-' at line 1

Insert stops after fifth '-' character. Even if $repeat is 0000-00-00
Field for that in database is date field in format 0000-00-00
I really don't know where problem is.
Thank you for helping.

Answer 1

repeat is a MySQL reserved word

• http://dev.mysql.com/doc/refman/5.5/en/reserved-words.html

Either rename it to something else; for example "repeats", or use ticks around it

(start,end,doctor,status,`repeat`)

Look at what MySQL is telling you; it's pointing it out where it starts:

...for the right syntax to use near 'repeat  
                                    ^

---

Sidenote:

• If you're still having problems inserting data into your table, you can sanitize your input(s) using mysqli_real_escape_string() or using prepared statements as stated below.

---

• I need to point out though, that your present code is open to SQL injection.
  Use prepared statements, or PDO with prepared statements, they're much safer.