<?php
include "session.php";
if(isset($_POST['permission'])) {
$x = $_POST['x'];
$reason = $_POST['reason'];
$leaving = $_POST['leaving'];
$returning = $_POST['returning'];
$query = "INSERT INTO permissions (reason, leaving, returning, user, x) VALUES('$reason', '$leaving', '$returning', '$login_session', '$x')";
$result = mysqli_query($db, $query);// or die('Error querying database!');
if ($result === false) { die(mysqli_error($db)); }
echo 'Thanks for Posting! Your request will be addressed as soon as possible!';
}
What is wrong with this code? The leaving and returning columns are of type- DATETIME. is that causing a problem?
<form method="post" action="" class="forms">
Type: <select name="x" required>
<option value="0">Leave</option>
<option value="1">Other</option>
</select>
<input type="text" name="reason" placeholder="Reason" required><br>
<input type="datetime-local" name="leaving"><br>
<input type="datetime-local" name="returning"><br>
<input type="submit" value="Request Permission" name="permission">
</form>
mysqliyou should be using parameterized queries andbind_paramto add user data to your query. DO NOT use string interpolation or concatenation to accomplish this because you have created a severe SQL injection bug. NEVER put$_POST,$_GETor any user data directly into a query, it can be very harmful if someone seeks to exploit your mistake.