PHP to insert values into SQL table

Question

So I am having this issue where i am getting the values from the POST, but when the insert query runs nothing is showing in the database, but I am getting no errors and the echos work. Here is my files:

config.php:

<?php

$host = "000webhost.com";
$user = "a9257*****";
$pass = "*****";
$db = "a9257*****";

$connect = mysql_connect($host, $user, $pass);
mysql_select_db($db, $connect);

?>

Here is my submit.php:

<?php

include "config.php";

$fname = $_POST['fname'];
$lname = $_POST['lname'];
$email = $_POST['email'];
$pass = md5($_POST['pass']);

$insert = 'INSERT INTO tblUsers (userFirstName, userLastName, userEmail, userPassword) VALUES("'.$fname.'","'.$lname.'""'.$email.'","'.$pass.'")';

mysql_query($insert);

echo $fname;
echo $lname;
echo $email;
echo $pass;

?>

Any help will be much obliged.

You're using the wrong mysql library. ext/mysql is deprecated. — Mike
– Mike, Commented Jul 27, 2013 at 21:57
mysql_query($insert) die('Error: ' . mysqli_error()); and it will show errors. — Erman Belegu
– Erman Belegu, Commented Jul 27, 2013 at 21:57
Are you sure there are no errors? You don't seem to be checking for errors coming back from MySQL. Given that your code is wide open to SQL injection attacks, just about anything could be happening in that query. — David
– David, Commented Jul 27, 2013 at 21:57
You should use single quotes for the string literals in your query. Double quotes are accepted by mysql but you could have problems when migrating to another rdbms. — Tobias Golbs
– Tobias Golbs, Commented Jul 27, 2013 at 21:58

Sterling Archer · Accepted Answer · 2013-07-27 22:25:14Z

2

$insert = 'INSERT INTO tblUsers (userFirstName, userLastName, userEmail, userPassword) VALUES("'.$fname.'","'.$lname.'","'.$email.'","'.$pass.'")';

You forgot a comma "'.$lname.'"HERE"'.$email.'"

Edit: escape your variables or your database will get hacked (will, not if ;) )

edited Jul 27, 2013 at 22:25

answered Jul 27, 2013 at 21:56

Sterling Archer

22.5k19 gold badges86 silver badges121 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Sterling Archer Over a year ago

Word.. I just saw the problem and gave an answer.

Sven · Accepted Answer · 2013-07-27 21:58:59Z

2

You get no errors because you are not asking MySQL to give them to you!

Change this line:

mysql_query($insert);

into this version:

mysql_query($insert, $connect) or die("MySQL error:". mysql_error($connect));

Let us know the error, or fix it directly yourself.

AND PLEASE ADD ESCAPING! All your values allow for SQL injection attacks!

And please do not use MD5 for password hashing! Starting at PHP 5.5 there are easy to use password hashing functions, that also have been backported to PHP 5.3.6. Please include this simple library: https://github.com/ircmaxell/password_compat

answered Jul 27, 2013 at 21:58

Sven

71.2k10 gold badges113 silver badges113 bronze badges

Collectives™ on Stack Overflow

PHP to insert values into SQL table

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related