我的php插入代码时出错

Question

There is an error:

Could not run query: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''')' at line 2

<?php
$servername = "127.0.0.1";
$username = "root";
// Create connection
$conn = mysql_connect($servername, $username,"");

// Check connection
if (!$conn) 
{
exit();
}
else
{
$id=$_POST['id'];
$name=$_POST['name'];

$sql="insert into make_master(make_id,make_name)
values($id,$name)";
mysql_select_db('pds', $conn);

$result = mysql_query($sql);

if (!$result) 
{

    echo 'Could not run query: ' . mysql_error();

}   
}




?>

Answer 1

You should change your code to use the mysqli interface, it's much more secure!

The reason your query is not working is because you need to quote the values for the SQL query to work:

insert into make_master(make_id,make_name) values ('$id','$name')

But it's not recommended to it that way, because it will make you vulnerable to SQL Injection. (Or in other words: You can be easily hacked)