I’ve been trying for hours to figure out what I’m doing wrong. The $trackName variable may include apostrophes. Also, some of the $subgenre and $mood variables may be NULL. This is my PHP code:
$sg2 = is_null($subgenre_2) ? NULL : $subgenre_2;
$sg3 = is_null($subgenre_3) ? NULL : $subgenre_3;
$sg4 = is_null($subgenre_4) ? NULL : $subgenre_4;
$sg5 = is_null($subgenre_5) ? NULL : $subgenre_5;
$md2 = is_null($mood_2) ? NULL : $mood_2;
$md3 = is_null($mood_3) ? NULL : $mood_3;
$query = "INSERT INTO `songs` (song_id, username, subgenre_1, subgenre_2, subgenre_3, subgenre_4, ";
$query .= "subgenre_5, mood_1, mood_2, mood_3, name, artist_name, active) ";
$query .= "VALUES ('" . $_SESSION['new_TK_data']['song-id'] . "', '" . $_SESSION['username'] ."', '";
$query .= $subgenre_1 . "', " . $sg2 . ", " . $sg3 . ", " . $sg4 . ", " . $sg5 . ", '";
$query .= $mood_1 . "', " . $md2 . ", " . $md3 . ", :name, '";
$query .= $_SESSION['new_TK_data']['artist_name'] . "', 1)";
$trackName = $_SESSION['new_TK_data']['name'];
$stmt = $pdo->prepare($query);
$stmt->bindParam(':name', $trackName, PDO::PARAM_STR);
$stmt->execute();
This is what $query shows before binding:
INSERT INTO `songs` (song_id, username, subgenre_1, subgenre_2, subgenre_3, subgenre_4, subgenre_5, mood_1, mood_2, mood_3, name, artist_name, active)
VALUES ('1peKZ91pGaS7QXzDBrICRy', 'romotony11', 'CONPNO', NEOCLA, SOLOPN, , , '6565', 4090, 1565, :name, 'Antonio Romo', 1)
This is the error I get:
Query failed: SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ‘ , ‘6565’, 4090, 1565, ‘Twilight Mood’, ‘Antonio Romo’, 1)’ at line 1
I’m not sure if the error comes from the null values, or from the single quotes missing in some values than come from variables, or from something else. I’ve tried many different things without success. Any help will be appreciated!