How can I fix error when inserting php form into mysql database

Question

I'm trying to save data from a form into a mysql database. I can connect to the database but for some reason I can't get it to insert the data into the database. I have a feeling it might just be a syntax error I'm not seeing.

Any help would be much appreciated.

PHP

// Get values from form 
 $Nombre=$_POST['Nombre'];
 $Email=$_POST['Email'];
 $Telefono=$_POST['Telefono'];

// Insert data into mysql 
$sql="INSERT INTO $leads(Nombre, Email, Telefono)VALUES('$Nombre','$Email','$Telefono')";
$result=mysql_query($sql);

// if successfully insert data into database, displays message "Successful". 
if($result){
echo "Successful";
echo "<BR>";
}

else {
echo "ERROR";
}

HTML

  <form action="leads.php" method="POST">
       <input placeholder="Nombre" type="text" name="Nombre" maxlength="40"/>
       <input placeholder="Email" type="text" name="Email" maxlength="100"/>
       <input placeholder="Teléfono" type="text" name="Telefono" maxlength="9" pattern=".{8,}"    required title="8 numeros mínimo"/>
       <button class="btn-cita" name="cita">Hacer Cita</button>
  </form>

mysql_query($sql) or die(mysql_error()); use this to get the error and posted the error here. — Krish R
– Krish R, Commented Mar 16, 2014 at 15:23
You should always try first echo $sql and look for if output is correct. This is kind of most basic debugging you could do when dealing with sql. — makallio85
– makallio85, Commented Mar 16, 2014 at 15:26

Marc B · Accepted Answer · 2014-03-16 15:21:50Z

1

Yes, you do. You are vulnerable to SQL injection attacks, and are using undefined variables in your query:

$sql="INSERT INTO $leads(Nombre, Email, Telefono)VALUES('$Nombre','$Email','$Telefono')";
                  ^^^^^^---undefined

Producing a query something like

INSERT INTO (Nombre, etc...

answered Mar 16, 2014 at 15:21

Marc B

362k44 gold badges433 silver badges508 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Ana Isabel Over a year ago

Do you know how I can fix this?

Ana Isabel Over a year ago

I just realized that I had written the name of the table 'leads' instead of using the $tbl_name variable I had set up. $sql="INSERT INTO $leads(Nombre, Email, Telefono)VALUES('$Nombre','$Email','$Telefono')"; $result=mysql_query($sql);

Collectives™ on Stack Overflow

How can I fix error when inserting php form into mysql database

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related