php code working incorrectly and not querying database

Question

I'm using php and a database to add books to a database.

HTML

<form method="POST" action="addbook.php">
<p>Enter Book title :<input type="text" name="bookname"></p>
<p>Enter Book Author :<input type="text" name="bookauthor"></p>
<p><input type="submit" value="addbook"></p>
</form>

PHP

$bname = $_POST['bookname'];
$bauthor = $_POST['bookauthor'];
$dbcon = mysqli_connect('localhost','root','password','bookstore') or die('asd');


$dbquery = "INSERT INTO books (title,author) VALUES ($bname,$bauthor)";

mysqli_query($dbcon,$dbquery) or die('not queryed');

echo "Your book has been added to your online library";

I'm getting the reply ' not queryed'

Your code is vulnerable to SQL injections, please read this : xkcd.com/327 — greg0ire
– greg0ire, Commented Dec 8, 2013 at 10:52
I suggest you change the end of the second last line to: or die(mysqli_error($dbcon);, and you will be able to see the specific error of your query. — EyalAr
– EyalAr, Commented Dec 8, 2013 at 10:53
Try $dbquery = "INSERT INTO books (title,author) VALUES ('$bname','$bauthor')"; — Shankar Narayana Damodaran
– Shankar Narayana Damodaran, Commented Dec 8, 2013 at 10:54

uofc · Accepted Answer · 2013-12-08 10:54:21Z

1

try putting single quotes around the values

ie

$dbquery = "INSERT INTO books (title,author) VALUES ('$bname','$bauthor')";

answered Dec 8, 2013 at 10:54

uofc

5605 silver badges13 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

randak · Accepted Answer · 2013-12-08 11:00:38Z

1

You should be using PDO and prepared statements in order to prevent SQL injection. The resultant PHP would be something like this:

$bname = $_POST['bookname'];
$bauthor = $_POST['bookauthor'];

$dbh = new PDO("mysql:host=$host;dbname=$dbname", $user, $pass); //Fill in these variables with the correct values ('localhost' for host, for example)

$st = $dbh->prepare("INSERT INTO books (title,author) VALUES (?,?)");
$data = array($bname, $bauthor);
$st->execute($data);

You can then add logic to check if the statement executed successfully.

Also, I think you just gave us your root password?

For more information about PDO, see this tutorial.

answered Dec 8, 2013 at 11:00

randak

2,0011 gold badge13 silver badges23 bronze badges

Comments

Bharath Krishna · Accepted Answer · 2013-12-08 11:05:03Z

0

Check the Column names in the table,whether they match with the one in the query.also check whether they are varchar itself.

I dont find any problem in the query, and also try putting

or die(mysqli_error());

and tell what exactly you can see.

If the type is varchar , you have to use single quotes around the values.

$dbquery = "INSERT INTO books (title,author) VALUES ('$bname','$bauthor')";

answered Dec 8, 2013 at 11:05

Bharath Krishna

371 silver badge8 bronze badges

Collectives™ on Stack Overflow

php code working incorrectly and not querying database

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related