What are the potential pitfalls of using quotes around the NOW() function in a MySQL query when inserting data from PHP?

Using quotes around the NOW() function in a MySQL query when inserting data from PHP can cause the NOW() function to be treated as a string rather than a function, resulting in the literal string "NOW()" being inserted into the database instead of the current timestamp. To solve this issue, the NOW() function should be used without quotes in the query to ensure that it is evaluated as a function by MySQL. 

// Incorrect way with quotes around NOW()
$query = "INSERT INTO table_name (column1, column2, created_at) VALUES ('value1', 'value2', 'NOW()')";

// Correct way without quotes around NOW()
$query = "INSERT INTO table_name (column1, column2, created_at) VALUES ('value1', 'value2', NOW())";

Keywords

MySQL NOW() PHP SQL injection data insertion

Related Questions