Question: I would like to add data from an html form into the database , here is my code

```
<html><?php

$var1=$_POST[tag];
$var2=$_POST[name];
$var3=$_POST[surname];

echo $var1;
echo $var2;
echo $var3;

$dbhandle=mysql_connect('localhost','root','mysql')
or die ("Unable to connect to database");
 mysql_select_db("arduino");

mysql_query("INSERT INTO door('Tag','Name','Surname') VALUES('$var1','$var2','$var3')");
?>
</html>

```

However, none of the data enters the database, i have put the echo statements so as to show that data from the form is received and it all works fine, but when i open the db, 

> 
> select \* from door 
> 
> 
> 

returns empty set.

Answer: 
Remove single quotes `'` from the column names in your query:

```
mysql_query("INSERT INTO door(Tag,Name,Surname) VALUES('$var1','$var2','$var3')");

```

If your intention is to escape the column names then mysql's escape character is back tick '`'. And they are only required if the column names or table names are one of the [reserved words](http://dev.mysql.com/doc/refman/5.5/en/reserved-words.html).
First of all i would not suggest you to use mysql but PDO or MySQLi. And your code is total vulnerable to attacks like sql injection and your db can be hacked easily. with PDO prepared statements you can use this as like

```
$pdoCon = new PDO('mysql:host=localhost;dbname=mydb', 'root', 'abc');
$stmt = $pdoCon->prepare("INSERT INTO door(Tag,Name,Surname) VALUES(?,?,?)");
$stmt->bindParam(1, $var1, PDO::PARAM_INT);
$stmt->bindParam(2, $var2, PDO::PARAM_STR, 20);
$stmt->bindParam(3, $var3, PDO::PARAM_STR, 20);
$stmt->execute();

```

it is total safe and much better to use and bet it will work like charm with no sql injection attack or any other. for more information read through <http://www.php.net/pdo.prepared-statements>