Question: I would like to add data from an html form into the database , here is my code

```
<html><?php

$var1=$_POST[tag];
$var2=$_POST[name];
$var3=$_POST[surname];

echo $var1;
echo $var2;
echo $var3;

$dbhandle=mysql_connect('localhost','root','mysql')
or die ("Unable to connect to database");
 mysql_select_db("arduino");

mysql_query("INSERT INTO door('Tag','Name','Surname') VALUES('$var1','$var2','$var3')");
?>
</html>

```

However, none of the data enters the database, i have put the echo statements so as to show that data from the form is received and it all works fine, but when i open the db, 

> 
> select \* from door 
> 
> 
> 

returns empty set.

Answer: 
You have quotes around your `column` names, so remove those

```
//Tag,Name,Surname

mysql_query("INSERT INTO door(Tag,Name,Surname) VALUES('$var1','$var2','$var3')");

                          ---^----^---^------^---

```

> 
> Note: Your code is vulnerable to SQL injection, also `mysql_()` API is now deprecated as of > PHP 5.5.0, consider using [`mysqli_()`](http://www.php.net/mysqli) or [PDO](http://php.net/pdo) instead.
> 
> 
> 

Read the big red box on [php.net](http://www.php.net/manual/en/function.mysql-connect.php)

![enter image description here](https://i.stack.imgur.com/5WCje.jpg)

---

You should always use error reporting in such cases, so if you are not going to use a different API, than use [`echo mysql_error($connection);`](http://www.php.net/mysql_error) which will give you a user friendly error message.
Remove single quotes `'` from the column names in your query:

```
mysql_query("INSERT INTO door(Tag,Name,Surname) VALUES('$var1','$var2','$var3')");

```

If your intention is to escape the column names then mysql's escape character is back tick '`'. And they are only required if the column names or table names are one of the [reserved words](http://dev.mysql.com/doc/refman/5.5/en/reserved-words.html).