Another MySQL insert problem? Error included this time.

[3raser]

$date = date('m-d-y');
$ip = $_SERVER['REMOTE_ADDR'];

mysql_query("INSERT INTO users VALUES ($username, $password, 0, $ip, $date)") or die(mysql_error());

 

Error:

 

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '.60.116, 03-06-11)' at line 1

 

I'm not sure why I get this error. :/

 

[kenrbnsn]

All strings need to be quoted in MySQL queries:

<?php
$q = "INSERT INTO users VALUES ('$username', '$password', 0, '$ip', '$date')";
$rs = mysql_query($q) or die("Problem with the query: $q <br>" . mysql_error());
?>

 

Ken

[3raser]

Thank you for that!

 

And should I do a MD5 password like this:

 

$password = mysql_real_escape_string(md5($_POST['password']));

 

Is escape even needed then?

[Pikachu2000]

There's no need to escape a string that will be hashed, so $password = md5($_POST['password']); is just fine.