Member Avatar for ElegantElephant 
$query = "INSERT INTO update_feedback (updateID,comment,timestamp) VALUES ('$updateID','$comment',NOW())";
$result = mysqli_query($dbcon,$result) or die('Error saving feedback into database. ' .mysqli_error($dbcon));

Gives me this error:

Error saving feedback into database. You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1' at line 1

  • 3 Contributors
  • 3 Replies
  • 115 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by ElegantElephant

Dani AI

Generated

Quick add-on that ties the replies together.

The error pointing at "'1'" means MySQL was given the literal 1 (or another non-SQL value) as the query string. As noted, the wrong PHP variable was being passed to the query function, so PHP ended up sending a non-string (often boolean true, which becomes "1") to MySQL and the server complained about the token 1. 's spacing check is a harmless quick test, but it wasn't the root cause here.

Practical debugging steps:

  • Dump the actual string being sent to MySQL (for example with var_dump/error_log) before calling the query to confirm it contains valid SQL.
  • Enable stricter mysqli error reporting during development to get exceptions and clearer stack traces: use mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT) (see the PHP manual).
  • Log the SQL you attempted and the mysqli error output rather than only dying, so you can inspect the faulty statement.

A slightly safer pattern is to use prepared statements (bind parameters instead of interpolating user data) and to quote identifiers that might clash with keywords (for example timestamp). Example using mysqli prepared statements:

$stmt = $dbcon->prepare("INSERT INTO update_feedback (`updateID`, `comment`, `timestamp`) VALUES (?, ?, NOW())");
$stmt->bind_param("is", $updateID, $comment);
$stmt->execute();
$stmt->close();

Notes and cautions:

  • Avoid building SQL by concatenating unescaped user input; use prepared statements to prevent SQL injection.
  • If a column name matches a MySQL keyword or datatype, wrap it in backticks or rename it; see the MySQL keyword list for reserved words.
  • In production, log errors properly instead of exposing raw DB messages to users.

Relevant docs: mysqli reporting and exceptions (mysqli report mode), prepared statements (mysqli::prepare), and MySQL keywords (MySQL reserved words).

Recommended Answers

All 3 Replies

Member Avatar for Kruptein

lol I even can't find a "1" in line 1 xD
try to delete the space between the table-name and the (
(It is possibly not the problem, but you can always try)

Edited by Kruptein because: n/a
Member Avatar for nav33n

$result = mysqli_query($dbcon,$result)

Is this a typo ? Apart from that, nothing is wrong with the query.

Member Avatar for ElegantElephant

Is this a typo ? Apart from that, nothing is wrong with the query.

Lol wow haha, I must've scanned through atleast 20 times, can't believed I missed it, thanks :)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.