php - unexpected '' (T_ENCAPSED_AND_WHITESPACE), expecting identifier (T_STRING) or variable (T_VARIABLE) or number (T_NUM_STRING) error -

in registration script, error keeps popping up. code such:

try {   $dbh = new pdo("mysql:host=$hostname;dbname=booter", $username, $password);      echo 'connected database<br />';  /*** insert data ***/ $count = $dbh->exec("insert members(username, password, email) values ('$_post['username']', '$hashedpassword', '$_post['email']')");   /*** close database connection ***/ $dbh = null; } catch(pdoexception $e) { echo $e->getmessage(); } 

any fixes (as tips security) appreciated.

the problem line:

('$_post['username']', '$hashedpassword', '$_post['email']') 

which quotes inside post arrays need removed.

however, isn't safe @ , should using prepared statements, leaves open sql injection.

first assign variable post arrays:

$username = $_post['username']; $hashedpassword = "the way you're getting from"; $email = $_post['email']; 

then using prepared statements using ? placeholders:

$query= "insert members (username, password, email) values (?, ?, ?)"; $result = $dbh->prepare($query); $count = $result->execute(array($username, $hashedpassword, $email)); 

---

more on pdo prepared statements can seen visiting:

• http://php.net/pdo.prepared-statements

---

footnotes:

i noticed in question posted https://stackoverflow.com/q/29177454/ using mysqli_ functions.

if still using mysqli_ connect or mysqli_ functions exist elsewhere in code, cannot mix mysql apis.