insert date into a MySQL Database - mysql

Question

I'm writing a script to insert data about books into a database.
This is the code that inserts the data
$errors=array();
foreach(array('title','author','publisher','pub_date','isbn','Format','genre','category','bookcase','shelf','user_id') as $key=>$val){
$_REQUEST[$key] = mysqli_real_escape_string($ptah,trim($_REQUEST[$val])) ;
};
$title = $_REQUEST['title'] ; $title = strip_tags($title);
$author = $_REQUEST['author'] ; $author = strip_tags($author);
$publisher = $_REQUEST['publisher'] ; $publisher = strip_tags($publisher);
$pub_date = $_REQUEST['pub_date'] ; $pub_date = strip_tags($pub_date);
$isbn = $_REQUEST['isbn'] ; $isbn = strip_tags($isbn);
$format = $_REQUEST['Format'] ; $format = strip_tags($format);
$genre = $_REQUEST['genre'] ; $genre = strip_tags($genre);
$category = $_REQUEST['category'] ; $category = strip_tags($category);
$bookcase = $_REQUEST['bookcase'] ; $bookcase = strip_tags($bookcase);
$shelf = $_REQUEST['shelf'] ; $shelf = strip_tags($shelf);
$username = $_REQUEST['user_id'] ; $username = strip_tags($username);
# On success, register user
if (empty($errors))
# Insert the user into the database
{
$insert_sql = "INSERT INTO library (title, author, publisher, pub_date, isbn, format, genre, category, bookcase, shelf, time_entered, by) VALUES ( '$title', '$author', '$publisher', '$pub_date', '$isbn', '$format', '$genre', '$category', '$bookcase', '$shelf', NOW(), '$username' )";
mysqli_query($ptah,$insert_sql) or die(mysqli_error($ptah));
mysqli_close($ptah);
exit();
};
?>
On submission, I get the following error.
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'by) VALUES ( 'Gently Does It', 'Hunter Alan', 'Robinson', '2010', '1234567890', ' at line 1
This misses out format, genre, category, bookcase, shelf, date entered and by whom completely.
Interestingly, the amount of data to be submitted will vary with the length of individual pieces,
for instance
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'by) VALUES ( 'The Hundred Year Old Man Who Climbed Out of a Window And Disappear' at line 1
doesn't even finish the title whereas
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'by) VALUES ( 'a', 'b', 'c', '1234', '1', 'Paperback', 'Fiction', 'Fantasy', 'a1'' at line 1
makes it as far as bookcase.
I'm stumped. Could anyone help please.

Answer 1

BY is a reserved word in MySQL so you should escape it with backticks ` in case you need to use it as a field name .
<...> , time_entered, `by`) <...>

Answer 2

BY is a reserved word in MySQL. In order to use it as an identifier in a query you need to enclose it with backticks:
... time_entered, `by`) VALUES (...
It's generally good practice to always enclose identifiers (column names, table names, etc.) with backticks anyway. It's more explicit to the query engine.