Using Safe-Mode Form Variables in mySQL Query

[Friend_Al_23]

I am in a safe mode, I think. Anyway, in order to receive form variables through post method, I have to use $_POST['variable_name'] in order to read that variable. But how do you do it when you want to include it in query? The code is written below:

$result = mysql_query("INSERT INTO mytable ('column1', 'column2') VALUES ($_POST['variable1'], $_POST['variable2']") or die ("Query Error: ".mysql_error());

The code above gives me an mySQL error stating that I should read the manual for the proper format. Isn't the above query in proper format already?

[robwatts]

Have you tried



$result = mysql_query("INSERT INTO mytable VALUES ('$_POST[variable1]', '$_POST[variable2]'") or die ("Query Error: ".mysql_error());

//if column1 was set to auto_increment you could do this instead

$result = mysql_query("INSERT INTO mytable VALUES ('', '$_POST[variable1]', '$_POST[variable2]'") or die ("Query Error: ".mysql_error());




I haven't ever had to declare the column names in any sql inserts Ive used.