title: get variable in php leading to database not accepted
body: <p>so i have this php code :</p>
  
  <pre><code>session_start();
  $servername = "localhost";
  $username = "root";
  $dbname = "3890ask3_db";
  
  
  $con = mysql_connect($servername, $username, "", $dbname)
    or die("Failed to connect to MySQL: " . mysql_error());
  
    $db=mysql_select_db($dbname,$con) 
    or die("Failed to connect to MySQL: " . mysql_error());  
  
    $query = mysql_query("SELECT * FROM register where Username = '$_SESSION[Username]'") or die(mysql_error()); 
     $row = mysql_fetch_array($query) or die(mysql_error());
  
      if(isset($_GET['selecttoy']))
      {
     $clname=$row['Name'];
     $clsurname=$row['Surname'];
     $clemail=$row['Email'];
     $stoy=$_GET['selecttoy'];
  
  
     $query2 = "INSERT INTO order (ClName, ClSurname, ClEmail, ToyCode , OrderID) VALUES ('$clname', '$clsurname', '$clemail' , '$stoy', ' ' )" ;
    if (mysql_query($query2)) {
      echo "Order created successfully!";
  } else {
      echo "Error: "  . "&lt;br&gt;" . mysql_error($con);
   }
  }
  
  ?&gt;
  </code></pre>
  
  <p>The php page can actually read the get variable,but as soon as i try to insert something in the database, i get this error message:</p>
  
  <p>"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'order (ClName, ClSurname, ClEmail, ToyCode , OrderID) VALUES ('mar', 'kyr', 'dgg' at line 1"</p>
  
  <p>i tried everything but no result...can someone please help me?
  thanks in advance....</p>