这个MySQL语法错误是怎么回事


What is with this MySQL syntax error?

我已经阅读了我的5.1.73 MySQL手册,当我尝试POST/GET时,我找不到MySQL给我的语法错误:

mysqli_query($connect,'INSERT INTO serial (name, company, algo, country, notes) VALUES ('.$_GET['name'].','.$_GET['company'].','.$_GET['algo'].','.$_GET['country'].','.$_GET['notes'].')');   

MySQL错误:

您的SQL语法有错误;查看与MySQL服务器版本对应的手册,了解在第1行"FCINGZ000***,未知,谢谢)"附近使用的正确语法

您应该将$_GET值分配给变量以防止语法错误。此外,请防止使用mysqli_real_escape_string()进行MySQL注入。

$name = mysqli_real_escape_string($connect, $_GET['name']);
$company = mysqli_real_escape_string($connect, $_GET['company']);
$algo = mysqli_real_escape_string($connect, $_GET['algo']);
$country = mysqli_real_escape_string($connect, $_GET['country']);
$notes = mysqli_real_escape_string($connect, $_GET['notes']);
mysqli_query($connect, "INSERT INTO serial (name, company, algo, country, notes) VALUES ('$name', '$company', '$algo', '$country', '$notes')");