我有一个<form>，我在INSERT INTO查询中发布，我需要能够在查询中嵌套查询？

Question

My question is pretty confusing but here we go. I a that i am using to post data into the 'blogposts' table. My problem arises for the last value of the query to be inserted is a picture(BLOB). This data needs to be pulled from the users profile aka(another table). So my question is, is there any way to have a SUBQUERY inside of the VALUES() statement in SQL to grab the profile pic of the account user?

Here is my code of the query that does not work:

<?php
    require_once('startsession.php');
    require_once('appvars.php');
    require_once('connectvars.php');

    $con=mysqli_connect(DB_HOST,DB_USER,DB_PASSWORD,DB_NAME);
    // Check connection
    if (mysqli_connect_errno())
      {
      echo "Failed to connect to MySQL: " . mysqli_connect_error();
      }

    $sql="INSERT INTO blogposts (name, subject, message, post_time, profPic)
    VALUES
    ('$_SESSION[username]','$_POST[subject]','$_POST[message]',current_timestamp,IN(SELECT picture
                                                                                    FROM player
                                                                                    WHERE user_id
                                                                                    EQUALS" . $_SESSION['user_id'] . ")";

    if (!mysqli_query($con,$sql))
      {
      die('Error: ' . mysqli_error($con));
      }
    echo "1 record added";

    mysqli_close($con);
    $page='index.php';
    header('Location:'.$page);
?>

Answer 1

$username = mysqli_real_escape_string($con,$_SESSION['username']);
$userid = mysqli_real_escape_string($con,$_SESSION['userid']);
$subject= mysqli_real_escape_string($con,$_POST['subject']);
$message= mysqli_real_escape_string($con,$_POST['message']);

$sql="INSERT INTO blogposts (name,subject,message,post_time,profPic)
SELECT '$username', 
 '$subject',  
 '$message', 
 CURRENT_TIMESTAMP, 
 picture
  FROM player WHERE user_id = '$user_id';";

$result = mysqli_query($con,$sql);

As mentioned in the comments, look into SQL Injection and the mysqli_real_escape_string function (http://php.net/manual/en/mysqli.real-escape-string.php)

EDIT: updated to include procedural style escape string and correct syntax