PHP MySQL Post Form

Question

So I've been wrestling with this issue all day. I can't seem to post anything into my table and I'm not sure why.

I've got a form built that has all the values that are being transferred for the _POST. Any pointers would be great.

elseif ($request == 'POST') {

include 'header_post.php'; include 'topmain.php';

$fname = $_POST['fname'];
$lname = $_POST['lname'];
$dlnum = $_POST['dlnum'];
$dob = $_POST['dob'];
$address = $_POST['address'];
$city = $_POST['city'];
$state = $_POST['state'];
$zip = $_POST['zip'];
$phone = $_POST['phone'];
$height = $_POST['height'];
$weight = $_POST['weight'];
$hair = $_POST['hair'];
$eyes = $_POST['eyes'];
$ethnicity = $_POST['ethnicity'];
}
$query3 = "insert into ".$db_prefix."customer_det (fname, lname, dlnum, dob, address, city, state, zip, phone, height, weight, hair, eyes, ethnicity) 
           values ('".$fname."', '".$lname."', '".$dlnum."', '".$dob."', '".$address."', '".$city."', '".$state."', 
           '".$zip."', '".$phone."', '".$height."', '".$weight."', '".$hair."', '".$eyes."', '".$ethnicity."')";

Becides the obvious sql injection, you're never executing the query anywhere. — Matthew
– Matthew, Commented Oct 18, 2012 at 17:25
Please let me know what site you're doing this for so I can practice up on my SQL injection skills. This is the most dangerous query I've seen in a while. — Ray
– Ray, Commented Oct 18, 2012 at 17:26

Arjun Abhynav · Accepted Answer · 2012-10-18 17:35:07Z

2

Using MySQL connection in PHP:

mysql_connect('DB_HOST','DB_USER','DB_PASS');
@mysql_select_db('DB_NAME');
$query='insert into ...';
mysql_query($query);

But your query is prone to SQL injections, and you are advised to use MySQLi extension.

    $mysql = new mysqli('DB_HOST', 'DB_USER', 'DB_PASS', 'DB_NAME');
    $query = 'insert into customer_det (
        fname,
        lname,
        dlnum,
        .......
    ) values (?,?,?,....,?)';
    $statement = $mysql->prepare($query);
    $statement->bind_param('sss...', //How many ever fields are there, those many sssss. For Integer use i. s is for string fields. Example ssssisssi....
        $fname,
        $lname,
        $dlnum,
        .....);
    $statement->execute();
    $statement->close();
    $mysql->close();

answered Oct 18, 2012 at 17:35

Arjun Abhynav

5434 silver badges15 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

mgraph · Accepted Answer · 2012-10-18 17:33:05Z

0

you should use mysql_query :

$query3 = mysql_query("insert..");

you should also add this before $fname = $_POST['fname']; to prevent the query at page load :

if(isset($_POST['fname'])){

 $fname = $_POST['fname'];
 ....
 $query3 = mysql_query("insert..");
}

edited Oct 18, 2012 at 17:33

answered Oct 18, 2012 at 17:25

mgraph

15.3k4 gold badges43 silver badges76 bronze badges

1 Comment

smada Over a year ago

I really appreciate it mgraph.

StaticVariable · Accepted Answer · 2012-10-18 17:25:10Z

0

You are not performing query

use $result=mysql_query($query3);

answered Oct 18, 2012 at 17:25

StaticVariable

5,2934 gold badges26 silver badges46 bronze badges

2 Comments

smada Over a year ago

Any idea why it's performing the query as soon as the page loads and not when it's submitted?

StaticVariable Over a year ago

use if(isset($_POST['hair'])){mysql_query($QUERY)}

Query · Accepted Answer · 2012-10-18 17:30:36Z

0

There must be a query called. use mysql_query();

As mentioned above, any variable using user inputted text that is stored in a database should be contained within the mysql_real_escape_string() to prevent SQL Injection.

answered Oct 18, 2012 at 17:30

Query

7292 gold badges7 silver badges24 bronze badges

2 Comments

smada Over a year ago

As i mysql_real_escape_string($variable) or mysql_real_escape_string($_POST['value'])

Query Over a year ago

Both would work, but since the variables are already being used in the query, go with the first one.

Collectives™ on Stack Overflow

PHP MySQL Post Form

4 Answers 4

Comments

1 Comment

2 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

1 Comment

2 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related