在php和SQL语法错误中INSERT INTO [关闭]

Im self learning mySQL and php few days and now Im stuck on this error and cant help myself. Can you look at code, Thanks!

this is error

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ')' at line 7

here is the page

switch($_GET['action']) {
case 'add':
  switch($_GET['type']) {
  case 'movie':
   $query = 'INSERT INTO 
            movie
                  (movie_name, movie_year, movie_type)
             VALUES 
                   ("' . $_POST['movie_name'] . '",
                     ' . $_POST['movie_year'] . ',
                     ' . $_POST['movie_type'] . ')';

          break;  
  }
   break;
}
  if (isset($query)) {
     $result = mysql_query($query, $db) or die(mysql_error($db));
  }

I think problem may be in here

 <td><select name='movie_type'> 
       <?php  

       $query = 'SELECT movietype_label FROM movietype ORDER BY movietype_id';
       $result = mysql_query($query, $db) or die (mysql_error($db));


       while ($row = mysql_fetch_assoc($result)) {
            foreach ($row as $value) {
            echo '<option value="' . $row['movietype_id'] . '">';
            echo $row['movietype_label'] . '</option>';

            }
       }

       ?>
       </select></td>

and here is print_r on

Array(
[movie_name] => asd
[movie_type] => 
[movie_year] => 2015
[submit] => ADD)

Shouldn't you be using a double quote " instead of single quote ' like below. You are mixing single and double quote.

   $query = "INSERT INTO 
            movie
                  (movie_name, movie_year, movie_type)
             VALUES 
                   ('" . $_POST['movie_name'] . "',
                     '" . $_POST['movie_year'] . "',
                     '" . $_POST['movie_type'] . "')";

Granted this is ugly, but would be surprised if it fails.

$query = "INSERT INTO 
movie (movie_name, movie_year, movie_type)
VALUES 
('" 
. $_POST['movie_name'] . "','"
. $_POST['movie_year'] . "','"
. $_POST['movie_type'] . "')";

Also, you need to cleanse your data. Data acted upon directly from user without cleansing, or sent through proper separation of code, can, and someday will, contain sql injection.

Ugly code like the above starts to take on some beauty with mysqli and pdo, plus the parameters are safely separated, and all the moaning about injection goes away.