PHP - Query to insert data into database

Question

I have been creating a registration system, and my code will not insert the fields: firstname, lastname, email and username into my database, however it will insert the hashed password into my database. I think the problem might have something to do with the for loop, but to me it seems like it should work.

<?php
if (isset($_POST['submit'])){
    require_once 'config.php';
        $hashed_password = password_hash($_POST["password"], PASSWORD_DEFAULT);
        $fields = ['firstname', 'lastname', 'email', 'username'];
        $escaped_values = [];
        foreach($fields as $field){
            $escaped_values[$field] = mysqli_real_escape_string($connect, $_POST['$field']);
        }
        $sql = "INSERT INTO users (firstname, lastname, email, username, password) VALUES ('{$escaped_values["firstname"]}', '{$escaped_values["lastname"]}', '{$escaped_values["email"]}', '{$escaped_values["username"]}', '$hashed_password')";
        mysqli_query($connect, $sql);
}
?>

Is $escaped_values are populated? what is that result of that array? — senK
– senK, Commented Feb 9, 2018 at 15:54
$_POST['$field'] <-- probably not doing what you're expecting. As a side note, I can't for the life of me work out why this code isn't a syntax error... — Jonnix
– Jonnix, Commented Feb 9, 2018 at 15:56
@JonStirling Yeah that would be a pretty weird name for an index... — GrumpyCrouton
– GrumpyCrouton, Commented Feb 9, 2018 at 15:56
You need ot change $_POST['$field'] to $_POST[$field] without the '. The single quotes make it a literal key. — user9189147
– user9189147, Commented Feb 9, 2018 at 15:59
Where is the syntax error in your opinion? I cant see it. @JonStirling — kscherrer
– kscherrer, Commented Feb 9, 2018 at 16:00

TCooper · Accepted Answer · 2018-02-09 16:02:12Z

1

I believe your error is in this line:

$escaped_values[$field] = mysqli_real_escape_string($connect, $_POST['$field']);

You should use $field in $_POST[] the same way you are in $escaped_values[], specifically, removing the single quotes.

Right now that loop is reading $field as a literal string each time it loops through, which most likely doesn't exist, giving you an empty $escaped_values array

edited Feb 9, 2018 at 16:02

answered Feb 9, 2018 at 16:00

TCooper

1,9701 gold badge14 silver badges20 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

kscherrer Over a year ago

To be more precise: use $POST_[$field] instead of $POST_['$field'] - no single quotes!

TessRay97 Over a year ago

Thank you, I've been pulling my hair out over this. I cant believe it was so simple as to removing the quotes :D Thank you all for the help

Collectives™ on Stack Overflow

PHP - Query to insert data into database

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related