title: Database error. You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax
body: <p>I am getting this error:</p>
  
  <blockquote>
    <p>An error occured: Database error. You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '@gmail.com, <code>salt</code> = , <code>iteration</code> = 12, <code>method</code> = blowfish, <code>person_id</code>' at line 1</p>
  </blockquote>
  
  <p>Here is the code:</p>
  
  <pre><code>$data_con = new data_abstraction;
  $data_con-&gt;execute_query("INSERT into `USER` SET `username` = $user, `password` = $phsh, `email` = $email, `salt` = $salt, `iteration` = $new_iteration, `method` = $new_method, `person_id` = $result2, `role_id` = $result4, `skin_id` = $result5");
  </code></pre>
  
  <p>Edit:</p>
  
  <p>I already used prepared the query, used parameterized statements and bind the parameters. The error has gone but the details I want to be inserted into the table are not added.</p>
  
  <p>Here is my code:</p>
  
  <pre><code>if(!($sql = $link-&gt;prepare("INSERT into `USER` SET 
                                      `username`  = ?, 
                                      `password`  = ?, 
                                      `email`     = ?, 
                                      `salt`      = ?, 
                                      `iteration` = ?, 
                                      `method`    = ?, 
                                      `person_id` = ?, 
                                      `role_id`   = ?, 
                                      `skin_id`   = ?"))){
                                          echo "SQL Query Preparation has failed";
                                      }
  
                      if(!($sql-&gt;bind_param("ssssisiii", $user, $phsh, $email, $new_salt, $new_iteration, $new_method, $result2, $result4, $result5))){
                          echo "Parameter Binding failed";
                      }
  
                      if(!($sql-&gt;execute())){
                          echo "MySQL Query Execution has failed";
                      }
  </code></pre>