inserting fields to MySql table using PHP

Question

I am trying to generate a script to insert comments on a blog to 'comments' table in MySsl database

<form action="insertcomment.php" method="post">
        <p class ="ctitle">Leave a Comment:</p>
        <p>
            <label for="name"><b>PostID:</b></label>
            <input type="text" id="postid" name="name" maxlength="4" /> <br/>

            <label for="name"><b>Name:</b></label>
            <input type="text" id="name" name="name" maxlength="25" /> <br/>

            <label for="email"><b>Email:</b></label>
            <input type="text" id="email" name="email" maxlength="50" /> <br/>

            <label for="website"><b>Website:</b></label>
            <input type="text" id="website" name="website" maxlength="25" /> <br/>

            <label for="content"><b>Comment:</b></label>
            <textarea id="content" name="content" cols="10" rows="4" maxlength="800"></textarea> <br/>

            <input type="submit" value="Submit Comment" name="submit_comment" /> <br/>
        </p>
        </form>

and my PHP script is as follows:

<?php
include("dbconnect.php");
$con=new dbconnect();
$con->connect();
error_reporting(E_ALL);

if(isset($_POST['submit'])) {


    $sSql = "INSERT INTO comments
         ( post_id,name, email, website,content)
         VALUES ('$_POST[postid]','$_POST[name]', '$_POST[email]', '$_POST[website]',  '$_POST[content]')";

    mysql_query($sSql);

    echo '<h2> Your Comment is submitted</h2><br />';
}


?>

But I was not able to insert my comment into database. my 'comments' table has comment_id,post_id,name,email,website,content,date_published fields. comment_id is the primary key. It has the option auto_increment. and date_published by default gives current time stamp. I was not able to figure out what my error is. Any thoughts would be appreciated.

Thank You!

how about adding some basic error checking (mysql_error()), and then seeing g this is hugely open to exploitation. — user557846
– user557846, Commented Jul 8, 2012 at 22:13
Replace mysql_query($sSql); with mysql_query($sSql) or die(mysql_error()); to print any errors from your query, however do note that you should not be using the mysql_* functions - they're deprecated. Use MySQLi instead. — Bojangles
– Bojangles, Commented Jul 8, 2012 at 22:13

Stegrex · Accepted Answer · 2012-07-08 22:21:22Z

You should use mysqli or PDO, but if you need to use the about-to-be depreciated mysql plugin:

<?php
include("dbconnect.php");
$con=new dbconnect();
$con->connect();
error_reporting(E_ALL);

if(isset($_POST['submit'])) {

foreach ($_POST as $key => $value) {
    $$key = mysql_real_escape_string($value); // You should always sanitize user inputs.
}


    $sSql = "INSERT INTO comments
         ( post_id,name, email, website,content)
         VALUES ($postid,'$name', '$email', '$website',  '$content')"; // No quotes around $postid because I'm assuming post_id column is an int type.

    mysql_query($sSql);

    echo '<h2> Your Comment is submitted</h2><br />';
}


?>

Notice the single quotes have been removed from $postid. This is because if table post_id is an int type, then you should not have quotes around the integer value.

Also, notice I've used the mysql_real_escape_string() function to clean your inputs. You should never ever quote direct user-inputted variables into SQL. It's very dangerous as users can use SQL injection attacks to gain access to your DB where they shouldn't or even possibly drop tables.

Still, I recommend converting to mysqli or PDO if at all possible, because the mysql plugin is about to be depreciated.

Collectives™ on Stack Overflow

inserting fields to MySql table using PHP

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related