Getting Unknown Column error on mysql_insert

[actionPunk]

Has anybody ever seen this?

I'm inserting a record into my DB, using a LoadVars object:

dbBridge.submit = function(){
this.title = title_txt.text;
this.author = author_txt.text;
this.price = price_txt.text;
this.jpeg = jpeg_txt.text;
this.review = review_txt.text;
this.sendAndLoad("http://serverurl/insertscript.php",this,"POST");
}


The PHP script that receives the call from the LoadVars object is this:

function putRecords(){
$this->connectDB();
$this->q = "insert into `".$this->table."` (title,author,price,jpeg,review) VALUES (";
$this->q.= $_POST['title'].",".$_POST['author'].",".$_POST['price'].",".$_POST['jpeg'];
$this->q.= ",".$_POST['review'].")";
echo "&query=".$this->q;
$this->result = mysql_query($this->q);
$this->num_result = mysql_affected_rows();
if($this->num_result == 1){
echo "Records inserted: ".$this->num_result;
}else{
$this->error = "&error=".mysql_error();
echo $this->error;
}
}


When I submit from the Flash form, I get an Unknown Column error. PHP seems to take title from the LoadVars and make it be whatever value was assigned to this.title in the LoadVars object.

So, my insert query is being built as:

insert into `tablename` (Golf in 24 Hours, Some Author, 14.99, cover.jpg, This book is a hole in 1!) VALUES ('Golf in 24 Hours', 'Some Author', '14.99', 'cover.jpg', 'This book is a hole in 1!')


Instead of the proper

insert into `tablename` (title, author, price, jpeg, review) VALUES ('Golf in 24 Hours', 'Some Author', '14.99', 'cover.jpg', 'This book is a hole in 1!')


Man, that's wierd! I've tried surrounding the column names with '', "" and ``. Nothing seems to help.

Anybody able to steer me right? Thanks!

[freddycodes]

Something a little cleaner.

function putRecords()
{
$this->connectDB();
$this->q = sprintf("insert into %s (title,author,price,jpeg,review) VALUES ('%s', '%s', '%s', '%s', '%s')",
$this->table,
$_POST['title'],
$_POST['author'],
$_POST['price'],
$_POST['jpeg'],
$_POST['review']
);
echo "&query=".$this->q;
$this->result = mysql_query($this->q);
$this->num_result = mysql_affected_rows();
if($this->num_result == 1)
{
echo "Records inserted: ".$this->num_result;
}
else
{
$this->error = "&error=".mysql_error();
echo $this->error;
}
}



Also you should think about sanitizing the $_POST array before using directly in a query like that to avoid sql injection attacks.