MySQL syntax error on line 1 and backtick suggesting an odd solution

Question

This request

$email = $mysqli->real_escape_string($_POST['email']); // User email. $key = RandomString(128); // A random string of 128 characters. $newTime = $_SERVER['REQUEST_TIME'] + 1800; // Expiration timer. $queries[] = "INSERT INTO verification ( email, key, time ) VALUES ( '$email', '$key', $newTime )"; $errors = false; $mysqli->autocommit(false); foreach ($queries as $query) { if (!$mysqli->query($query)) { $errors = true; } } 

gives me the following error:

You have an error in the SQL syntax; check the manual that matches the version of your MySQL server for the correct syntax to use next to the key, time. VALUES (' [e-mail] ', 'e1e4091197640bae0a4588b8666e87b6b' on line 1.

But the query above works by simply adding a few backward steps (serious emphasis):

 $queries[] = "INSERT INTO verification ( `email`, `key`, `time` ) VALUES ( '$email', '$key', $newTime )"; 

Can someone explain how this change will fix the problem?

Answer 1

time and key are reserved words. If you intend to use them for a column name, which is a bad idea, they require backreferences to avoid them.

Answer 2

Backticks are required in MySQL whenever an identifier name is a reserved word. In your case, KEY is a reserved word and will cause syntax errors if you do not attach it like that. It is generally recommended to avoid creating names like this.

You can find a list of reserved words here .

Answer 3

Try this - you cannot use such a key, as it is a mysql reservation keyword. use tild (`) around it to take it as a field.

 $queries[] = "INSERT INTO verification ( email, `key`, time ) VALUES ( '$email', '$key', $newTime )";