PHP Form Post to MySQL database error

Question

I have a working form on my site that successfully inserts the fields into a MySQL database table. I added a new table, basically copied the existing code for the new form, and am getting an error. I've tweaked it a bunch and am baffled.

Here's the form:

    <form action="contact.php" method="post">
    <input type="hidden" name="submitted" value="true" />

<fieldset>
    <label>First Name: <input type="text" name="firstname" required="" /> </label><br />
    <label>Last Name: <input type="text" name="lastname" required /> </label><br />
    <label>Email Address: <input type="text" name="email" required /> </label><br />
    <label>Anniversary Date: <input type="date" name="weddingdate" /> </label><br />
    <label>Birthday: <input type="date" name="birthday"  /> </label><br />
    <label>Business Name: <input type="text" name="business" /> </label><br />
    <label>Are You A Chamber Member?: <input type="radio" name="chamber" value="memyes">Yes   <input type="radio" name="chamber" value="memno"> No<br />
    <label>Comments: <input type="textarea" name="comments" rows="2" cols="50"> </label>
</fieldset>
<input type="submit" value="Enter Me In The Contest!" />
</form>

The contact.php file looks like this:

    if (isset($_POST['submitted'])) {
include('dbconnect.php');

$firstname = $_POST['firstname'];
$lastname = $_POST['lastname'];
$email = $_POST['email'];
$weddingdate = $_POST['weddingdate'];
$birthday = $_POST['birthday'];
$business = $_POST['business'];
$chamber = $_POST['chamber'];
$comments = $_POST['comments'];

$sqlinsert = "INSERT INTO contest (`firstname`, `lastname`, `email`, `weddingdate`, `birthday`,`business`, 'chamber', 'comments') VALUES ('$firstname', '$lastname', '$email', '$weddingdate', '$birthday', '$business', '$chamber', '$comments')";

if (!mysqli_query($dbcon, $sqlinsert)) {
    die('Error adding to database');    
}
header('Location: website omitted');
}

I know that it connects properly, I'm using the same connection script for both, and did a test of the connection adding a connection echo message.

All I get with this script is the "Error adding to database" message...

Thanks in advance for the advice and help!

@skrilled, instead of snark, try educating the user on what he's doing wrong. — castis
– castis, Commented Jan 8, 2014 at 23:47
@castis I wish I could thumb up a comment more than once. I really dislike 'I'm the God of Programming and all who know less deserve worse' kind of poeple — Rottingham
– Rottingham, Commented Jan 8, 2014 at 23:47
castis: well i'm tired of typing out "sanitize your database input" every 5 minutes on this site. are we assuming OP has no clue how to google? little bobby tables = first result on google. — skrilled
– skrilled, Commented Jan 8, 2014 at 23:47
Plus you quoted two of your (INSERT into) columns 'chamber', 'comments' which should be backticks as you did for the others. — Funk Forty Niner
– Funk Forty Niner, Commented Jan 8, 2014 at 23:48

Funk Forty Niner · Accepted Answer · 2014-01-09 01:06:42Z

1

Two of your INSERT columns (chamber and comments) had single quotes instead of backticks.

(.......`weddingdate`, `birthday`,`business`, 'chamber', 'comments')
                                              ^       ^  ^        ^

The method you're presently using for your inputs is unsafe, so that's been replaced by incorporating the mysqli_real_escape_string() function.

$firstname = $_POST['firstname']; (not recommended)

$firstname= mysqli_real_escape_string($dbcon, $_POST['firstname']); (recommended)

N.B.: It's not always a good idea to use a hidden field to check if it is isset - You risk in getting empty data without checking for empty fields, which you're not doing.

You could rather name your submit button and use if (isset($_POST['submit']))

For example:

<input type="submit" name="submit" value="Enter Me In The Contest!" />

yet, that's entirely up to you.

PHP

if (isset($_POST['submitted'])) {
include('dbconnect.php');

$firstname= mysqli_real_escape_string($dbcon, $_POST['firstname']);
$lastname= mysqli_real_escape_string($dbcon, $_POST['lastname']);
$email= mysqli_real_escape_string($dbcon, $_POST['email']);
$weddingdate= mysqli_real_escape_string($dbcon, $_POST['weddingdate']);
$birthday= mysqli_real_escape_string($dbcon, $_POST['birthday']);
$business= mysqli_real_escape_string($dbcon, $_POST['business']);
$chamber= mysqli_real_escape_string($dbcon, $_POST['chamber']);
$comments= mysqli_real_escape_string($dbcon, $_POST['comments']);


$sqlinsert = "INSERT INTO `contest` (`firstname`, `lastname`, `email`, `weddingdate`, `birthday`,`business`, `chamber`, `comments`) VALUES ('$firstname', '$lastname', '$email', '$weddingdate', '$birthday', '$business', '$chamber', '$comments')";

if (!mysqli_query($dbcon, $sqlinsert)) {
    die('Error adding to database');    
}
header('Location: website omitted');
}

edited Jan 9, 2014 at 1:06

answered Jan 9, 2014 at 0:30

Funk Forty Niner

74.2k14 gold badges71 silver badges146 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

MarcT Over a year ago

Thank you for the quick education. It was definitely the Back-Ticks that had me messed up. I'm new still to the PHP side of things, and appreciate the extra help on my code. I've successfully used this script and am adjusting the other PHP form connection script I am using currently to match it for the security reasons mentioned.

MarcT Over a year ago

I would have UP voted, but I'm new enough to this site to not be able at the moment.

Funk Forty Niner Over a year ago

You're welcome and glad I could help and pass on the education at the same time. The Web is not the friendly place that many think it is and we need to protect ourselves. @MarcT

arkyc · Accepted Answer · 2014-01-09 00:01:57Z

0

Try removing the quotes from around your column names like this:

$sqlinsert = "INSERT INTO contest (firstname, lastname, email, weddingdate, birthday,business, chamber, comments) VALUES ('$firstname', '$lastname', '$email', '$weddingdate', '$birthday', '$business', '$chamber', '$comments')";

answered Jan 9, 2014 at 0:01

arkyc

1496 bronze badges

6 Comments

Funk Forty Niner Over a year ago

It's best to keep the backticks around the column names. FYI: I'm NOT the downvoting type, just in case someone does it to you. I sure don't like it myself but hey... they're only points and they're not real. If you stand by your convictions, then let it ride ;-) Cheers --- You're theoretically correct, but again... backticks are best and for so many reasons.

arkyc Over a year ago

Hey no problems. That's why I said "try" :) I guess I should have done a little more research before answering. Lesson learnt :)

Funk Forty Niner Over a year ago

I like to "share the wealth" as it were. ;-)

Funk Forty Niner Over a year ago

I didn't know any better than the next guy many months ago, so it pleases me to share what I know that has been "tried, tested, and true", and I learn most of it right here on SO. Mind you, Google is an indispensible tool.

arkyc Over a year ago

In theory, my answer may still solve the problem given the backticks are not used on the business and chamber columns. Maybe.

|

Cynthia Fridsma · Accepted Answer · 2014-01-09 00:34:37Z

First of all, I want to say this little warning to you: your script is screaming "I'm open for SQL injections." You've no protection at all.

Always use at least addslashes....

---// your script (adjusted) //-----

    <?php

    if (isset($_POST['submitted'])) {
        include('dbconnect.php');

        $firstname = addslashes($_POST['firstname']);
        $lastname = addslashes($_POST['lastname']);
        $email = addslashes($_POST['email']);
        $weddingdate = addslashes($_POST['weddingdate']);
        $birthday = addslashes($_POST['birthday']);
        $business = addslashes($_POST['business']);
        $chamber = addslashes($_POST['chamber']);
        $comments = addslashes($_POST['comments']);

        $sqlinsert = "INSERT INTO contest (firstname, lastname, email, weddingdate,
 birthday, business, chamber, comments) VALUES 
('".$firstname."', '".$lastname."', '".$email."', '".$weddingdate."', 
                    '".$birthday."', '".$business."', '".$chamber."', '".$comments."')";


            if(mysqli_query($dbcon, $sqlinsert)){

                echo "Query &nbsp;done :-)<br>";
            } else {
                echo mysqli_error($dbcon) . "<hr>";
            }

        }

---// your script (adjusted) //-----

You can, of course also use mysqli_real_escape_string instead of using addslashes:

<?php
$query = mysqli_real_escape_string($dbcon,$sqlinsert);

Anyway, if you run this script and you run into an MySQL error then the script will send an error message to your screen. You can take it up from there ;-)

P.s. your script isn't working because of the way you've defined your fields in your query: you use : business, and 'chamber' together in the field names....

MarcT · Accepted Answer · 2014-01-09 16:31:14Z

0

Thank you for the quick education. It was definitely the Back-Ticks that had me messed up. I'm new still to the PHP side of things, and appreciate the extra help on my code. I've successfully used this script and am adjusting the other PHP form connection script I am using currently to match it for the security reasons mentioned.

answered Jan 9, 2014 at 16:31

MarcT

131 bronze badge

Collectives™ on Stack Overflow

PHP Form Post to MySQL database error

4 Answers 4

3 Comments

6 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

3 Comments

6 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related