SQL插入请求语法错误排查求助（含PHP代码及报错信息）

提交表单执行INSERT语句时出现如下SQL语法错误：

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '', '1', '1')' at line 1

测试多种输入数据后问题仍存在，经排查代码存在两处关键错误：

• 变量名错误：mysqli_set_charset函数调用时使用了未定义的$con变量，实际数据库连接变量为$db，需修正；
• SQL语法错误：INSERT语句中$radical_reading变量前缺失单引号，导致SQL语句结构不完整，触发语法错误。

以下是修复后的完整HTML+PHP代码：

<!DOCTYPE html>
<html lang="en">
    <head>
        <meta charset="UTF-8">
        <title>BFFChinese</title>
    </head>

    <body>
        <p class="main_title">There is a main page that needed to navigate you on the website!</p>
        
        <!--
        <a href="http://shizza.beget.tech/login.php">Goto register/login page...</a><br>
        <a href="http://shizza.beget.tech/radicals.php">Goto radicals page...</a><br>
        -->
        
        <div class="form_container">
            <h2>Register</h2>
            <p>Try to add a radical &lt;3</p>
                
            <form action="" method="post">
                <div class="form_element">
                    <label>Radical name:</label>
                    <input type="text" name="radical_name" class="form_element_control" required>
                </div>
                
                <div class="form_element">
                    <label>Radical reading (pinyin):</label>
                    <input type="text" name="radical_reading" class="form_element_control" required>
                </div>
                
                <div class="form_element">
                    <label>Radical stroke count (just number, like 1 or 5):</label>
                    <input type="text" name="radical_stroke_count" class="form_element_control" required>
                </div>
                    
                <div class="form_element">
                    <label>Radical mnemonic:</label>
                    <input type="text" name="radical_mnemonic" class="form_element_control" required>
                </div>
                    
                <div class="form_element">
                    <input type="submit" name="submit" class="btn_submit" value="Add radical">
                </div>
            </form>
        </div>
        
        <?php
            $db = mysqli_connect("localhost", "shizza_bffc", "5&avXr7Z", "shizza_bffc");
            mysqli_set_charset($db, "utf32"); // 修正：将$con改为$db
        
            $sql = 'CREATE TABLE IF NOT EXISTS bffc_radicals (radical_id int NOT NULL AUTO_INCREMENT, radical_name TINYTEXT, radical_reading TINYTEXT, radical_stroke_count int, radical_mnemonic TINYTEXT, PRIMARY KEY (radical_id))';
            $result = mysqli_query($db, $sql);
        
            //$sql = 'CREATE TABLE IF NOT EXISTS users (login TINYTEXT, pass TINYTEXT, rank TINYTEXT)';
            //$result = mysqli_query($db, $sql);

            if($_POST){
                if (($_POST['submit'] ?? null) === "Add radical") {
                    $radical_name = $_POST['radical_name'];
                    $radical_reading = $_POST['radical_reading'];
                    $radical_stroke_count = $_POST['radical_stroke_count'];
                    $radical_mnemonic = $_POST['radical_mnemonic'];
                    $rank = "user";
                    
                    // 修正：为$radical_reading添加前单引号
                    $sql = "INSERT INTO bffc_radicals (radical_name, radical_reading, radical_stroke_count, radical_mnemonic) VALUES ('$radical_name', '$radical_reading', '$radical_stroke_count', '$radical_mnemonic')";
                    $result = mysqli_query($db, $sql);
                    
                    if ($result) {
                        echo "<br> Nicely added! <br>";
                    } else {
                        echo "<br> Something is wrong! SQLError -> " . mysqli_error($db) . " <br>";
                    }
                }
                /*
                else {
                    $login = $_POST['login'];
                    $pass = $_POST['pass'];
                    
                    $sql = "SELECT * FROM users WHERE login='$login' AND pass='$pass'";
                    $result = mysqli_query($db, $sql);
                    
                    if ($result && $result->num_rows == 1) {
                        echo "Successfully logined :P";
                    } else {
                        echo "Something happened :C. This is an error provided by SQL -> " . mysqli_error($db);
                    } echo "<br>";
                }
                */
            }
        ?>
    </body>
</html>

额外提示：当前代码存在SQL注入风险，建议使用**预处理语句（prepared statements）**替代直接拼接变量的方式，提升代码安全性。

内容的提问来源于stack exchange，提问作者Nikolai Bogdanov