Insert into SQL database user input from HTML form

Question

I am trying to insert into column "UserId" in my sql database, using php, text that the user inputs in the HTML form. Below is a basic example to help me figure out what I am doing wrong.

HTML

<html>
<form action="index1.php" method ="post" name="trial">

    <input type="text" name="testName" id="testId">
    <br>
    <input type="submit" value="Submit">

</form>
</html>

PHP

$servername = "localhost";
$username = "root";
$password = "xx";
$dbname = "wp";

$conn = new mysqli($servername, $username, $password, $dbname);

if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
} 

$UserId = $_POST['testName'];

$sql = "INSERT INTO UserProfile (UserId) VALUES ('$testName')";

if ($conn->query($sql) === TRUE) {
    echo "New record created successfully";
} else {
    echo "Error: " . $sql . "<br>" . $conn->error;
}

$conn->close();

Some notes:

I can connect to database and insert in the correct columns checkbox and radio values from the form
I cannot find a way to insert in the database the user text input from the form (UserProfile is the table and UserId the column). Would using a javascript variable, like below one, help?
```
var testVar = document.getElementById("testId").value;
```
I know I am opening myself to hacking using the above code, I would like to improve it later on but I think I need to first figure out the basics (ie: how to get the user text input added to the database)

Than you in advance for any help!

You are declaring $UserId but you're trying to insert $testName. Which is whats wrong! — L Ja
– L Ja, Commented Sep 26, 2017 at 16:22
should be : $sql = "INSERT INTO UserProfile (UserId) VALUES ('$UserId')"; — Jigar Shah
– Jigar Shah, Commented Sep 26, 2017 at 16:22
"I know I am opening myself to hacking using the above code, I would like to improve it later on but I think I need to first figure out the basics" — Doing it the right way (with prepared statements and bound variables) means throwing out a large portion of the code you are writing. It's a false economy, you are just teaching yourself bad habits. — Quentin
– Quentin, Commented Sep 26, 2017 at 16:24

burn · Accepted Answer · 2017-09-26 16:39:37Z

4

you are storing the value in $UserId, not in $testName:

Change your SQL Query to

$sql = "INSERT INTO UserProfile (UserId) VALUES ('$UserId')";

I think this will help. BTW: Think about SQL-Injection! Look here: How can I prevent SQL injection in PHP?

answered Sep 26, 2017 at 16:39

burn

411 bronze badge

Sign up to request clarification or add additional context in comments.

Comments

Mohamed Abulnasr · Accepted Answer · 2017-09-26 16:59:08Z

0

Look here

$sql = "INSERT INTO UserProfile (UserId) VALUES ('$testName')";

Change $testName to $UserId in sql statement because it's the name of your new variable in php:

$UserId = $_POST['testName'];
$sql = "INSERT INTO UserProfile (UserId) VALUES ('$UserId')";

But I advice you to:

1- use PDO for any sql handling in php

2- use mysqli_real_escape_string to protect your code from threats.

make it like:

$UserId = mysqli_real_escape_string($con, $_POST['testName']);

edited Sep 26, 2017 at 16:59

answered Sep 26, 2017 at 16:34

Mohamed Abulnasr

5977 silver badges18 bronze badges

4 Comments

Rotimi Over a year ago

Please do not give answers with security vulnerabilities

Mohamed Abulnasr Over a year ago

what is wrong in security in my code sample? explain to me please i'm confused now!!!!

Rotimi Over a year ago

Google prepared statements using mysqli

Mohamed Abulnasr Over a year ago

Thank you, i am editing it to explain him how to protect the insert

Collectives™ on Stack Overflow

Insert into SQL database user input from HTML form

2 Answers 2

Comments

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related