Error querying database in php script

Question

i m trying to insert some data from form and it is giving error every time "error querying database" my coding is this

<?php
 $dbc = mysqli_connect('localhost', 'root', '', 'askquestion')
    or die('Error connecting to MySQL server.');   

   $first_name=$_POST['firstname'];
   $last_name=$_POST['lastname'];
   $email=$_POST['email'];
   $password=$_POST['password'];
   $state=$_POST['state'];
   $city=$_POST['city'];
   $category=$_POST['category'];


    $query = "INSERT INTO signup (first_name, last_name, email, password, state, city, category)  VALUES ('$first_name', '$last_name', $email, $password, $state, $city, $category)";

    $result=mysqli_query($dbc, $query) or die('Error querying database.'). mysql_error();;


    echo 'you are registered...!';

   mysqli_close($dbc);


   ?>

Community · Accepted Answer · 2023-11-17 20:42:18Z

1

You're vulnerable to SQL Injection attacks. Always escape your incoming POST values, using mysql_real_escape_string(). This helps to prevent SQL injection, and it ensures that all values being used in your query statement that have special characters are escaped properly (e.g. quotes).

Additionally, make sure all string values are properly wrapped in quotes in your VALUES statement.

edited Nov 17, 2023 at 20:42

CommunityBot

11 silver badge

answered May 18, 2011 at 22:31

AJ.

28.3k19 gold badges89 silver badges98 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Henrik P. Hessel Over a year ago

thats no really an answer to the question, isn't it?

AJ. Over a year ago

Absolutely, because if the incoming POST values were escaped, the special characters wouldn't break the INSERT statement.

Michael Berkowski · Accepted Answer · 2011-05-18 22:44:26Z

0

Have a look at your query, you have

'$last_name', $email, $password, $state, $city, $category)

Whereas you should have:

$query = "INSERT INTO signup (first_name, last_name, email, password, state, city, category)  VALUES ('$first_name', '$last_name', '$email', '$password', '$state', '$city', '$category')";

Also, try to use

die(mysql_error());

in development

For SQL security, you should always escape each input value:

$first_name=mysql_real_escape_string($_POST['firstname']);

edited May 18, 2011 at 22:44

Michael Berkowski

271k47 gold badges450 silver badges395 bronze badges

answered May 18, 2011 at 22:32

bear

11.7k27 gold badges82 silver badges132 bronze badges

1 Comment

shekhar Over a year ago

Thank you so much........it was a silly mistake. and i also put that mysql_real code in. Thanks a lot. Its working now.

dgamma3 · Accepted Answer · 2011-05-18 22:49:49Z

when inserting values into a database you need quotes around the variables or values which are strings, you don't need quotes around integers/floats or numbers.

All the values you are getting from the POST super global are strings of text, i would assume. therefore replace this: (check your table structure if this doesn't work):

$query = "INSERT INTO signup (first_name, last_name, email, password, state, city, category)  VALUES ('$first_name', '$last_name', $email, $password, $state, $city, $category)";

with this:

$query = "INSERT INTO signup (first_name, last_name, email, password, state, city, category) VALUES ('$first_name', '$last_name', '$email', '$password', '$state', '$city', '$category')";

for more information, read here: http://www.w3schools.com/sql/sql_insert.asp

Collectives™ on Stack Overflow

Error querying database in php script

3 Answers 3

2 Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related