-2

I am trying to do something really simple here. All I want to do is to insert information in MySQL Here is the code below for the form.

 <?php
 $host=""; // Host name 
 $username=""; // Mysql username 
 $password=""; // Mysql password 
 $db_name=""; // Database name 
 $tbl_name=""; // Table name 

 // Connect to server and select database.
 mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
 mysql_select_db("$db_name")or die("cannot select DB");

 // get value of id that sent from address bar
 $dj=$_GET['dj'];

 // Retrieve data from database 
 $sql="SELECT * FROM $tbl_name WHERE dj='$dj'";
 $result=mysql_query($sql);
 $rows=mysql_fetch_array($result);
 ?>

<table width="400" border="0" cellspacing="1" cellpadding="0">
<tr>
<form name="form1" method="post" action="insert_ac.php">
<td>
<table width="100%" border="0" cellspacing="1" cellpadding="0">
<tr>
<td>&nbsp;</td>
<td colspan="3"><strong>Insert The information for the Now PlayingProgram.</strong>
</td>
</tr>
<tr>
<td align="center">&nbsp;</td>
<td align="center">&nbsp;</td>
<td align="center">&nbsp;</td>
<td align="center">&nbsp;</td>
</tr>
<tr>
<td align="center">&nbsp;</td>
<td align="center"><strong>Name</strong></td>
<td align="center"><strong>Email</strong></td>
<td align="center"><strong>Email2</strong></td>
</tr>
<tr>
<td>&nbsp;</td>
<td align="center">
<input name="name" type="text" id="name" value="">
</td>
<td align="center">
<input name="email" type="text" id="email" value="" size="15">
</td>
<td>
<input name="email2" type="text" id="email2" value="" size="15">
</td>
</tr>
<tr>
<td align="center">&nbsp;</td>
<td align="center"><strong>Twitter</strong></td>
<td align="center"><strong>Twitter2</strong></td>
<td align="center"><strong>Avatar</strong></td>
</tr>
<tr>
<td>&nbsp;</td>
<td align="center">
<input name="twitter" type="text" id="twitter" value="">
</td>
<td align="center">
<input name="twitter2" type="text" id="twitter2" value="" size="15">
</td>
<td>
<input name="avatar" type="text" id="avatar" value="" size="15">
</td>
</tr>
<tr>
<td align="center">&nbsp;</td>
<td align="center"><strong>Facebook</strong></td>
<td align="center"><strong>Facebook2</strong></td>
<td align="center"><strong>Type</strong></td>
</tr>
<tr>
<td>&nbsp;</td>
<td align="center">
<input name="facebook" type="text" id="facebook" value="">
</td>
<td align="center">
<input name="facebook2" type="text" id="facebook2" value="" size="15">
</td>
<td>
<input name="type" type="text" id="type" value="" size="15">
</td>
</tr>
<tr>
<td align="center">&nbsp;</td>
<td align="center"><strong>Alias1</strong></td>
<td align="center"><strong>Alias2</strong></td>
<td align="center"><strong>Alias3</strong></td>
</tr>
<tr>
<td>&nbsp;</td>
<td align="center">
<input name="alias1" type="text" id="alias1" value="">
</td>
<td align="center">
<input name="alias2" type="text" id="alias2" value="" size="15">
</td>
<td>
<input name="alias3" type="text" id="alias3" value="" size="15">
</td>
</tr>

<tr>
<td align="center">&nbsp;</td>
 <td colspan="3" align="center"><strong>Request Line</strong></td>
</tr>
<tr>
<td>&nbsp;</td>
<td colspan="3" align="center">
 <input name="address" type="text" id="address" value="" size="65">
 </td>
 </tr>
 <tr>
 <td>&nbsp;</td>
 <td>
 <input name="dj" type="hidden" id="dj" value="">
 </td>
 <td align="center">
 <input type="submit" name="Submit" value="Submit">
 </td>
 <td>&nbsp;</td>
 </tr>
 </table>
 </td>
 </form>
 </tr>
 </table>
  <?php
 // close connection 
 mysql_close();
 ?>

Now what I want to be able to do is to insert the information in the database that I enter in this form. Well my issue is when I enter some data and click on submit, all i get is ERROR.

So lets take a look at my incert_ac.php code is below:

<?php
 $host=""; // Host name 
 $username=""; // Mysql username 
 $password=""; // Mysql password 
 $db_name=""; // Database name 
 $tbl_name=""; // Table name 

 // Connect to server and select database.
 mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
 mysql_select_db("$db_name")or die("cannot select DB");

 // Connect to server and select database.
 mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
 mysql_select_db("$db_name")or die("cannot select DB");

 // insert data in mysql database 
 $sql="INSERT INTO $tbl_name (name, email, email2, twitter, twitter2, avatar, facebook, facebook2, type, alias1, alias2, alias3, address, dj)
  VALUES('{$_POST[name]}', '{$_POST[email]}', '{$_POST[email2]}', '{$_POST[twitter]}', '{$_POST[twitter2]}', '{$_POST[avatar]}', '{$_POST[facebook]}', '{$_POST[facebook2]}', '{$_POST[type]}', '{$_POST[alias1]}', '{$_POST[alias2]}', '{$_POST[alias3]}', '{$_POST[address]}', '{$_POST[dj]}')";
 $result=mysql_query($sql);

 // if successfully inserted 
 if($result){
 echo "Successful";
 echo "<BR>";
 echo "<a href='list_records.php'>View result</a>";
 echo "1 record added";
 }

 else {
echo "ERROR";
}

?>

I would like to know if I am just having a syntax or even a spelling issue here! Any help would be appreciated.

10
  • 1
    Maybe because your variable $tbl_name is always empty Commented Oct 8, 2012 at 5:11
  • i removed that infomation for secuity reasons Commented Oct 8, 2012 at 5:13
  • Re-check whether all these fields name, email, email2, twitter, twitter2, avatar, facebook, facebook2, type, alias1, alias2, alias3, address, dj are exist in the table $tbl_name Commented Oct 8, 2012 at 5:18
  • To find error, try using mysql_errno() and mysql_error() and tell us what error mysql returns Commented Oct 8, 2012 at 5:20
  • 1
    "$host"? Cargo-cult programming... Commented Oct 8, 2012 at 5:22

1 Answer 1

3

The column names name and type need to go in tick marks as they are reserved names in MySQL.

Update the $sql= lines to the following code:

$sql = "INSERT INTO $tbl_name (`name`, email, email2, twitter, twitter2, avatar, facebook, facebook2, `type`, alias1, alias2, alias3, address, dj) VALUES (
    '".mysql_real_escape_string($_POST['name'])."',
    '".mysql_real_escape_string($_POST['email'])."',
    '".mysql_real_escape_string($_POST['email2'])."',
    '".mysql_real_escape_string($_POST['twitter'])."',
    '".mysql_real_escape_string($_POST['twitter2'])."',
    '".mysql_real_escape_string($_POST['avatar'])."',
    '".mysql_real_escape_string($_POST['facebook'])."',
    '".mysql_real_escape_string($_POST['facebook2'])."',
    '".mysql_real_escape_string($_POST['type'])."',
    '".mysql_real_escape_string($_POST['alias1'])."',
    '".mysql_real_escape_string($_POST['alias2'])."',
    '".mysql_real_escape_string($_POST['alias3'])."',
    '".mysql_real_escape_string($_POST['address'])."',
    '".mysql_real_escape_string($_POST['dj'])."')";

EDIT: added some SQL input sanitization

Sign up to request clarification or add additional context in comments.

5 Comments

sorry but that did not solve my issue
This is vulnerable to SQL Injection, though. While you're at it, you could correct this wrongness too
I added some sanitization to the insert statement.
ok i tried this as well and still did not work
Try echoing out $sql and running through an editor such as mysql workbench so you can see exactly what error is occurring and where in your SQL statement.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.