ทําไมมัน You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'order VALUES (0, '37', '2', 'TONER', '450', '1')' at line 1

<?php
session_start();
$sid = session_id();
include "storescripts/connect_to_mysql.php";
$sql = "SELECT * FROM cart WHERE sid = '$sid';";
$result_cart = mysql_query($sql);
if(mysql_num_rows($result_cart) == 0) {
	die("ท่านไม่เลือกสินค้าไว้ในรถเข็น");
}

$firstname = "";
$lastname = "";
$address = "";
$zipcode = "";
$phone = "";
$email = "";
$payment = "";
$errmsg = "";
if($_POST) {
	//ตรวจสอบความถูกต้องของข้อมูล
	foreach($_POST as $k => $v) {
		if(empty($v)) {
			$errmsg = "ท่านยังใส่ข้อมูลไม่ครบ";
			break;
		}
		$v = stripslashes($v);
		$v = htmlspecialchars($v, ENT_QUOTES);
		
		$_POST[$k] = $v;
	}

}
	$firstname = $_POST['firstname'];
	$lastname = $_POST['lastname'];
	$address = $_POST['address'];
	$zipcode = $_POST['zipcode'];
	$phone = $_POST['phone'];
	$email = $_POST['email'];
	$payment = $_POST['payment'];
	
	if($errmsg == "") {
		$sql = "INSERT INTO members VALUES
					(0, '$firstname','$lastname', '$address','$zipcode', '$phone', '$email','$payment');";
					
		@mysql_query($sql) or die(mysql_error());
		
		$cid = mysql_insert_id();
		
		$sql = "SELECT * FROM cart WHERE sid = '$sid';";
		$result = mysql_query($sql);
		
		while($cart = mysql_fetch_array($result)) {
			$pid = $cart['pid'];
			$product_name = $cart['product_name'];
			$price = $cart['price'];
			$quantity = $cart['quantity'];
			$sql = "INSERT INTO order VALUES
					(0, '$cid', '$pid', '$product_name', '$price', '$quantity');";

			@mysql_query($sql) or die(mysql_error());
		}
		
		$sql = "DELETE FROM cart WHERE sid = '$sid';";
		@mysql_query($sql) or die(mysql_error());
		
		if($_POST['save_cookie']) {
			$expire = time() + 12*30*24*60*60; 				//เก็บไว้ 1 ปี
			setcookie('firstname', $_POST['firstname'], $expire);
			setcookie('lastname', $_POST['lastname'], $expire);
			setcookie('address', $_POST['address'], $expire);
			setcookie('zipcode', $_POST['zipcode'], $expire);
			setcookie('phone', $_POST['phone'], $expire);
			setcookie('email', $_POST['email'], $expire);

	}
}
else if($_COOKIE) {
	$firstname = $_COOKIE['firstname'];
	$lastname = $_COOKIE['lastname'];
	$address = $_COOKIE['address'];
	$zipcode = $_COOKIE['zipcode'];
	$phone = $_COOKIE['phone'];
	$email = $_COOKIE['email'];
}
?>