Database error. You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax
<p>I am getting this error:</p>

<blockquote>
  <p>An error occured: Database error. You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '@gmail.com, <code>salt</code> = , <code>iteration</code> = 12, <code>method</code> = blowfish, <code>person_id</code>' at line 1</p>
</blockquote>

<p>Here is the code:</p>

<pre><code>$data_con = new data_abstraction;
$data_con-&gt;execute_query("INSERT into `USER` SET `username` = $user, `password` = $phsh, `email` = $email, `salt` = $salt, `iteration` = $new_iteration, `method` = $new_method, `person_id` = $result2, `role_id` = $result4, `skin_id` = $result5");
</code></pre>

<p>Edit:</p>

<p>I already used prepared the query, used parameterized statements and bind the parameters. The error has gone but the details I want to be inserted into the table are not added.</p>

<p>Here is my code:</p>

<pre><code>if(!($sql = $link-&gt;prepare("INSERT into `USER` SET 
                                    `username`  = ?, 
                                    `password`  = ?, 
                                    `email`     = ?, 
                                    `salt`      = ?, 
                                    `iteration` = ?, 
                                    `method`    = ?, 
                                    `person_id` = ?, 
                                    `role_id`   = ?, 
                                    `skin_id`   = ?"))){
                                        echo "SQL Query Preparation has failed";
                                    }

                    if(!($sql-&gt;bind_param("ssssisiii", $user, $phsh, $email, $new_salt, $new_iteration, $new_method, $result2, $result4, $result5))){
                        echo "Parameter Binding failed";
                    }

                    if(!($sql-&gt;execute())){
                        echo "MySQL Query Execution has failed";
                    }
</code></pre>