PHP script thrown Error #1054 in MySQL when column is exist-CodePudding

Good day everyone!

My querry:

$name    = $vm_product->product_name;

$columns = array('cart_id', 'product_id', 'quantity', 'price', 'name');
$values  = array($cart_id, $product_id, $quantity, $price, $name);

$query
           ->insert($db->quoteName('#__products'))
           ->columns($db->quoteName($columns))
           ->values(implode(',', $values));

$db->setQuery($query);
$db->execute();

If $name is number only, as example $name = 100 everything is OK.

But if $name is string, as example $name = "Cable" an error is thrown:

1054 - Unknown column 'Cable' in 'field list'

Why 1054? "Cable" is not column!

CodePudding user response：

Because when you implode, your values becomes WHERE column_name IN (Cable,Another string,Some other value) and that is syntax error because of missing quotes around string literals (when there is no spaces in strings, mysql assumes its names of columns).

Use ->values("'" . implode("','", $values) . "'"), or consult your used code base documentation how to properly and securely generate WHERE IN condition