mysql error with insert command

Question

So , am creating a password change table

When some 1 changes pass , i insert his username, newpass and the confirmation code in PassChange table, (so i send him a confirmation e-mail after) the idea is simple and here's the code i use

 $insertResult=mysql_query("INSERT INTO TempChangePass (UserName, NewPass, ConfirmationCode) VALUES ('$UserName', '$newPass', '$code')") or die (mysql_error());

though i get this error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'username'', '4da59df8d4007807e7230e0881fbf774', '16585482')' at line 1

NOTE: All the columns format in the table is set to varchar.

The connection to mysql database is fine, the table name is currect.

This problem is driving me crazy , i just can't figure out where the problem is, if anyone here can help me will be very thankful :)

and thanks in advance.

EDIT: I actually got it solved, and just for people who visit this post by searching for solutions, if you got similar problem with your sql command, try echo it, and see how exactly the string is moved to the database :-) , happy coding everyone.

And sorry if I wasted any of your time :) am just very new to php & mysql :D

Answer 1

Remove the single quotes around your variables. PHP is interpreting them as strings.

 $insertResult=mysql_query("INSERT INTO TempChangePass (UserName, NewPass, ConfirmationCode) VALUES ('" . $UserName. "', '" . $newPass. "', '" . $code . "')") or die (mysql_error());

Additionally, you might want to do something like this:

$sql = "INSERT INTO TempChangePass (UserName, NewPass, ConfirmationCode) VALUES ('" . $UserName. "', '" . $newPass. "', '" . $code . "')";

echo $sql;

Take that echo, and try to manually run it.