PDO致命錯誤檢查語法

Question

出於某種原因，我對包括第二行代碼開始報這個錯誤：

Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'div='CA' WHERE vid='400373'' at line 1' in /home/stretch045/public_html/scripts/auth.php:12 Stack trace: #0 /home/stretch045/public_html/scripts/auth.php(12): PDO->prepare('UPDATE users SE...') #1 /home/stretch045/public_html/index.php(35): Auth->checkToken('94257b73ea4ed51...') #2 {main} thrown in /home/stretch045/public_html/scripts/auth.php on line 12

代碼

$conn = $this->db; 
$stmt = $conn->prepare("UPDATE users SET rating='".$xml->rating."', atc='".$xml->ratingatc."', pilot='".$xml->ratingpilot."', div='".$xml->division."' WHERE vid='".$xml->vid."'"); 
$stmt->execute(); 
if($stmt->rowCount()==0){ 
    $stmt = $conn->prepare("INSERT INTO users (vid, fname, lname, rating, atc, pilot, div) VALUES (".$xml->vid.",".$xml->firstname.",".$xml->lastname.",".$xml->rating.",".$xml->ratingatc.",".$xml->ratingpilot.",".$xml->division.")"); 
    $stmt->exec($stmt); 
    echo 'data inserted into db'; 
} 

Answer 1

div是reserved keyword in MySQL，需要通過轉義反引號。

INSERT INTO users (vid, ..., `div`) VALUES (...)