CODEWITHSUNDEEP
phpmysqlinsertwebdev.webserver
user2865156
user2865156

Reputation: 311

I am trying to get some form data with php and put it in my mysql db, not sure what's wrong

I am trying to teach my self how to code websites and I need to get some info from a form and put it in my mysql db, and from what I have gathered the best way to do what I want is to use php. When I hit the submit button, the script in my index.php executes but nothing gets put in the db. the script links to another script that is out side my web root. I needed to put it out there because it contains passwords (is there a better way to do this?) this may be part of my problem. Below are the relevant pieces of code:

 <?php
 $con=mysqli_connect("192.168.1.125","root","pass","site");
 // Check connection
 if (mysqli_connect_errno())
 {
 echo "Failed to connect to MySQL: " . mysqli_connect_error();
 }

 $sql="INSERT INTO users (Email)
 VALUES
 ('$_POST[email]')";

 if (!mysqli_query($con,$sql))
 {
 die('Error: ' . mysqli_error($con));
 }
 echo "1 record added";

 mysqli_close($con);
 ?>

and

        <?php
    // define variables and set to empty values
    $emailErr = "";
    $email = $password = "";
    $file = basename(urldecode($_GET['insert.php']));
    $fileDir = '/var/insert.php';

    if ($_SERVER["REQUEST_METHOD"] == "POST")
    {
        if (empty($_POST["email"]))
            {$emailErr = "email is required";}
        else
            {$email = test_input($_POST["email"]);
            if (!preg_match("/([\w\-]+\@[\w\-]+\.[\w\-]+)/",$email))
                {
                $emailErr = "Invalid email format";
                }
            }
    }

    function test_input($data)
    {
        $data = trim($data);
        $data = stripslashes($data);
        $data = htmlspecialchars($data);
        return $data;
    }

    if (file_exists($fileDir . $file))
    {
    // Note: You should probably do some more checks 
    // on the filetype, size, etc.
    $contents = file_get_contents($fileDir . $file);

    // Note: You should probably implement some kind 
    // of check on filetype
    header('Content-type: php');

    echo $contents;
    }
    ?>
        <form method="POST" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>">
        <input id="email" placeholder=" email" type="email" name="email" maxlength="50">
        <input id="pass" placeholder=" Password" type="password" name="pass" maxlength="25">
        <button id="submit">SUBMIT</button></form>
    </div>
    </div><div id="date" align="center"><img src="192.168.1.125/date.png"></div>
    <?php
    echo "<h2>Your Input:</h2>";
    echo "$email";
    echo "$emailErr";
    ?>

Upvotes: -1

Views: 68

Answers (2)

AbraCadaver
AbraCadaver

Reputation: 79024

$email = mysqli_real_escape_string($con, $_POST['email']);
$sql="INSERT INTO users (Email)
 VALUES
 ('$email')";

Upvotes: 0

user2092317
user2092317

Reputation: 3348

change the line, 

  $sql="INSERT INTO users (Email) VALUES ('$_POST[email]')";

with

  $sql="INSERT INTO users (Email) VALUES ('".$_POST['email']."')";

Upvotes: 1

Related Questions