Cant seem to get this to work. could some one please point me out into the right direction with an example how to fi this. thank you. i need this url domain.com/script.php?from=1123&message=1234454
to insert velues into my table
<?php
mysql_connect('localhost', 'user', 'pass');
mysql_select_db('dbname');
$sql = "insert into table (from, message) values ('".$_GET['from']."','".$_GET['message']."')";
if(!$sql){
echo "Error " . mysql_error(); }
else{ echo "Success"; }
?>
try adding
mysql_query($sql);
So it actually adds to the db at the moment you are just creating a string
mysql_query, especially not when none of the parameters are properly escaped. Do it properly. Posting answers like this is only teaching dangerous techniques.You are never calling mysql_query() to actually execute the query.
<?php
mysql_connect('localhost', 'user', 'pass');
mysql_select_db('dbname');
$from = mysql_real_escape_string($_GET['from']);
$message = mysql_real_escape_string($_GET['message']);
// TODO: check that $from and $message are not empty and are valid
$sql = "insert into table (from, message) values ('$from','$message')";
$result = mysql_query($sql); // This actually executes the query on the server
if(!$result) {
echo "Error " . mysql_error();
} else {
echo "Success";
}
The call to mysql_real_escape_string is very important as well. Without it, you are vulnerable to SQL injection.
Also, the mysql_* functions are deprecated. You should switch to Mysqli or PDO_Mysql.
echo $sql; before you run the query. What is the full output?First you have to check if the variables are set.
if(isset($_GET['from'],$_GET['message'])){
$con = mysql_connect('localhost', 'user', 'pass');
mysql_select_db('dbname',$con);
$from = mysql_real_escape_string($_GET['from']);
$message = mysql_real_escape_string($_GET['message']);
// TODO: check that $from and $message are not empty and are valid
$sql = "insert into table (from, message) values ('$from','$message')";
$result = mysql_query($sql);
if(!$result) { echo "Error " . mysql_error(); }
else {
echo "Success";
mysql_close($con);
}
}else{die();}
mysql_query. Please don't do this.