HTML form not populating MySQL DB as expected

Question

When I save a form from html to php and finally store it in MySQL somewhere in that line it save the var= including what comes after the =

Here is my html:

   <form action="searchResultsSave.php" method="POST">
     What are we looking for? <input type="text" name="searchVar" />
     <input type="submit" value="Submit">
   </form>

Php:

    $searchVar = file_get_contents('php://input');

    $sql = "INSERT INTO g_information(searchVar) VALUES ('$searchVar')";

    if ($conn->query($sql) === TRUE) {
        echo "New record created successfully";
    } else {
        echo "Error: " . $sql . "<br>" . $conn->error;
    }

Finally my output in mysql is: "searchVar=cars" when it should just be "cars".

Where do you think I went wrong?

I am not a PHP person, it should be $_POST['searchVar'] not all the post params.... — epascarello
– epascarello, Commented Nov 10, 2017 at 16:24
Why use the input stream? Use parameterized queries would be better. Please only tag languages being used. — chris85
– chris85, Commented Nov 10, 2017 at 16:25
What is the purpose of file_get_contents() and "php://input" where no file object is submitted? — guest271314
– guest271314, Commented Nov 10, 2017 at 16:28

Suman B · Accepted Answer · 2017-11-10 16:40:19Z

1

$searchVar = file_get_contents('php://input');

should be

$searchVar = $_POST['searchVar'];

This way you get the value of the search term.

answered Nov 10, 2017 at 16:40

Suman B

841 silver badge6 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Tadasbub · Accepted Answer · 2017-11-10 16:42:04Z

1

You should read input variable from the form

    <?php
    $_POST["searchVar"];
    ?>

Then do some validation on the input, making sure no illegal characters are entered and data is safe to store in MySQL database

    <?php
    $_POST['searchVar'] = filter_var($_POST['searchVar'], FILTER_SANITIZE_STRING);
    $sql = "INSERT INTO g_information(searchVar) VALUES ("'.$_POST['searchVar'].'")"; 
    ?>

answered Nov 10, 2017 at 16:42

Tadasbub

2061 silver badge7 bronze badges

Collectives™ on Stack Overflow

HTML form not populating MySQL DB as expected

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related