[php] You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '''')' at line 2

I am getting an Error in MySQL:

You have an error in your SQL syntax; check the manual that corresponds 
to your MySQL server version for the right syntax to use near '''')' at line 2'.

HTML Code:

<form action="read_message.php" method="post">
  <table class="form_table">
    <tr>
      <td style="font-weight:bold;">Subject:</td>
      <td><input style=" width:300px" name="form_subject"/></td>
      <td></td>
    </tr>
    <tr>
      <td style="font-weight:bold;">Message:</td>
      <td id="myWordCount">&nbsp;(300 words left)</td>
      <td></td>
    </tr>
    <tr>
      <td><input type="hidden" name="sender_id" value="<?php echo $sender_id?>"></td>
      <td><textarea cols="50" rows="4" name="form_message"></textarea></td>
      <td valign="bottom"><input type="submit" name="submit_message" value="send"></td>
    </tr>
  </table>
</form>

Code to insert into a mysql table:

<?php
  include_once"connect_to_mysql.php";
  //submit new message
  if($_POST['submit_message']){

    if($_POST['form_subject']==""){
      $submit_subject="(no subject)";
    }else{
      $submit_subject=$_POST['form_subject'];   
    }
    $submit_message=$_POST['form_message'];
    $sender_id = $_POST['sender_id'];
    if($shortMessagesLeft<1){
      $form_error_message='You have left with '.$shortMessagesLeft.' Short Message. Please purchase it from the <a href="membership.php?id='.$id.'">shop</a>.';
    }
    else if($submit_message==""){
      $form_error_message = 'Please fill in the message before sending.';
    }
    else{
      $message_left = $shortMessagesLeft-1;
      $update_short_message = mysql_query("UPDATE message_count SET short_message = '$message_left' WHERE user_id = '$id'");
      $sql = mysql_query("INSERT INTO private_messages (to_id, from_id, time_sent, subject, message) 
        VALUES('$sender_id', '$id', now(),'$submit_subject','$submit_message')") or die (mysql_error());
    }
  }

?>

What does the error mean and what am I doing wrong?

I had this problem before, and the reason is very simple: Check your variables, if there were strings, so put it in quotes '$your_string_variable_here' ,, if it were numerical keep it without any quotes. for example, if I had these data: $name ( It will be string ) $phone_number ( It will be numerical ) So, it will be like that:

$query = "INSERT INTO users (name, phone) VALUES ('$name', $phone)"; Just like that and it will be fixed ^_^

I was getting the same error when I used this code to update the record:

@mysqli_query($dbc,$query or die()))

After removing or die, it started working properly.

That's called SQL INJECTION. The ' tries to open/close a string in your mysql query. You should always escape any string that gets into your queries.

for example,

instead of this:

"VALUES ('$sender_id') "

do this:

"VALUES ('". mysql_real_escape_string($sender_id)  ."') "

(or equivalent, of course)

However, it's better to automate this, using PDO, named parameters, prepared statements or many other ways. Research about this and SQL Injection (here you have some techniques).

Hope it helps. Cheers

Please make sure you have downloaded the sqldump fully, this problem is very common when we try to import half/incomplete downloaded sqldump. Please check size of your sqldump file.