PHP：WHERE子句附近的查询（MySQL）出错

Question

I am trying to Insert data from a form with the use of a query. The query ( below ) has a WHERE clause to pick a position from visitorsystem.position.

 $query = "INSERT INTO visitorsystem.employee(idNumber,name,surname,position,email)
                                 VALUES ('$idNumber','$name','$surname',SELECT positionid FROM visitorsystem.position WHERE position LIKE '%$position%','$email')";

When executed the following error is given. I have tried adding quotes and single quotes around the SELECT...WHERE clause with no luck. Any ideas if the problem is with the query itself or the SELECT...WHERE clause ?

Error in query: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '','fdsf',SELECT positionid FROM visitorsystem.position WHERE position LIKE '%inf' at line 2

Answer 1

First of all, learn about prepared Statements to prevent SQL injection.

Second you should add all values to the select Statement:

query = "INSERT INTO visitorsystem.employee(idNumber,name,surname,position,email)
  SELECT $idNumber,'$name','$surname',positionid,'$email' FROM visitorsystem.position WHERE position LIKE '%$position%'";

Also you do not need singlequotes around $idNumber, because it is numeric