CODEWITHSUNDEEP
phpdatabasepost
rogerthat
rogerthat

Reputation: 1815

EDIT: variables still go into db without retrieving them; POST displaying variables in url PHP

This still works even with the corrected form method and without retrieving the values on the insert.php page. Why?

  <!doctype html>

 <html>

<head>
<title></title>
</head

<body>
<form action="insert.php" method="post">
    First Name: <input type="text" name="fname" /><br>
    Last Name: <input type="text" name="lname" /><br>
    Username:  <input type="text" name="uname" /><br>

    <input type="submit" name="submit" value="Register"/><br>
</form>

</body>
</html>

insert.php

<?php

 $con=mysqli_connect("","","","");
 // Check connection
if (mysqli_connect_errno())
 {
 echo "Failed to connect to MySQL: " . mysqli_connect_error();
 }

$sql="INSERT INTO traders (fname, lname, username)
VALUES
('$fname','$lname','$uname')";

if (!mysqli_query($con,$sql))
{
   die('Error: ' . mysqli_error($con));
} 
echo "1 record added " ;

mysqli_close($con);
?>

Upvotes: 0

Views: 380

Answers (3)

Kylie
Kylie

Reputation: 11749

You need to change from 

<form action="insert.php" action="post">

To...

<form action="insert.php" method="post">

Also.....you need to retrieve the values....

$fname = $_POST['fname'],  $lname = $_POST['lname'];  //etc etc

And do bound statements instead, for extra security...

Like so...

$mysqli = new mysqli('YOUR DETAILS HERE');


$stmt = $mysqli->prepare("INSERT INTO traders (fname, lname, username) VALUES (?, ?, ?)");
$stmt->bind_param('sssd', $_POST['fname'], $_POST['lname'], $_POST['uname']);
$stmt->execute();

Upvotes: 0

Erman Belegu
Erman Belegu

Reputation: 4079

Use the POST method like this

<form action="insert.php" method="post">

Upvotes: 0

Jerzy Zawadzki
Jerzy Zawadzki

Reputation: 1985

You have two action in form tag - change 2nd to method

<form action="insert.php" method="post">
    First Name: <input type="text" name="fname" /><br>
    Last Name: <input type="text" name="lname" /><br>
    Username:  <input type="text" name="uname" /><br>

    <input type="submit" name="submit" value="Register"/><br>
</form>

because method was not found - it assumed GET.

Also instead of $fname, $lname, etc. use $_POST['fname'],$_POST['lname'], etc.

And learn more about binding variables into query

Upvotes: 4

Related Questions