Parse error: syntax error, unexpected (T_VARIABLE), expecting ',' or ')'

[WeDomHo]

My php URL: https://shop.wedomho.ga/plan/free/user.php

PHP:
<?php
session_start();

$connection = mysql_connect("localhost", "root", "") or die(mysql_error());
$db = mysql_select_db("accountant", $connection);

if(isset($_POST) && !empty($_POST)){
$fullname = $_POST['fullname'];
$email = $_POST['email'];
$address = $_POST['address'];
$city = $_POST['city'];
$state = $_POST['state'];
$zip = $_POST['zip'];
$query = mysql_query("INSERT INTO table(fullname,email,address,city,state,zip) Values("$fullname","$email","$address","$city","$state","$zip")");

//Session Work
$_SESSION['form_data'] = $_POST;
header ('location' : 'index.html');
}
?>

It says: Parse error : syntax error, unexpected ‘$fullname’ (T_VARIABLE), expecting ‘,’ or ‘)’ in /home/vol10_2/epizy.com/epiz_23755195/shop.wedomho.ga/htdocs/plan/free/user.php on line 14

How to solve it?

[Admin]

Did you look at the way the forum highlighted your code? The variables you placed in the SQL statement are not the same color as the SQL statement itself. You’re using the double quote both as the string delimiter in PHP as well as the string delimiter in the SQL statement, so PHP is thinks it’s PHP code.

The quick fix could be to (note the difference in colors compared to your code):

// Use single quotes for the PHP string
mysql_query('INSERT INTO table(fullname,email,address,city,state,zip) Values("$fullname","$email","$address","$city","$state","$zip")');

// or use single quotes for the MySQL string
mysql_query("INSERT INTO table(fullname,email,address,city,state,zip) Values('$fullname','$email','$address','$city','$state','$zip')");

But ideally, you should not create SQL queries this way at all. Just dumping unfiltered form input in your SQL query is a great way to get your database hacked, because it leaves you wide open to SQL Injection Attacks. You should either validate or sanitize the input variables, or use parameterized statements to separate the data from the queries.

Also, to save you from having to write more follow-up messages:

• The database credentials you are using are not correct. Check the MySQL Databases in the control panel instead.
• The header ('location' : 'index.html') is not valid. It should be header ('location: index.html') instead.