使用PHP将数据输入MySQL数据库时出现问题

Question

I have been checking my syntax all night yet I can't seem to see what is wrong. I'm relatively new to all this and would appreciate nay help that may be provided. The error I'm getting is

"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''ID','Name','Option','Sides') VALUES(NULL,'Denise','Chicken','Mashed Potat' at line 1"

My code is below:

<?php
include 'connect.php';

$name = $_POST['inputName'];
$opt = $_POST['inputOption'];
$side = $_POST['inputSides'];

if(!$_POST['Submit']) {
    echo "Please fill out the form.";
    header('Location: index.php');
} else {
    mysql_query("INSERT INTO people ('ID','Name','Option','Sides')
                VALUES(NULL,'$name','$opt','$side')") or die(mysql_error());
    echo "User has been added.";
    header('Location: index.php');
    }
?>

Answer 1

You're using the wrong identifiers for your columns:

('ID','Name','Option','Sides')

Either remove the quotes or wrap them in backticks.

(`ID`,`Name`,`Option`,`Sides`)

Plus, your present code is open to SQL injection.
Use mysqli with prepared statements, or PDO with prepared statements, they're much safer.

Another thing; should you want to be entering apostrophes, use stripslashes() including mysql_real_escape_string(). The occasion may very well present itself; an insight.

• Otherwise, SQL will throw another error.