CODEWITHSUNDEEP
php
user3189704
user3189704

Reputation: 1

inserting data from a form into your mysql database using php

i used this code 

   <?php
    $conn = new PDO("mysql:host=localhost;dbname=CU4726629",'CU4726629','CU4726629'); 
    $sql="INSERT INTO review (username, movie_name, ratings) VALUES ("$_POST['username']","$_POST['moviename']","$_POST['ratings']")";

   header('Location: reviews.php');  
  ?>

but it keeps giving me this error

Parse error: syntax error, unexpected T_VARIABLE in /home/4726629/public_html/check_login.php on line 5

Upvotes: 0

Views: 51

Answers (4)

sjpatel
sjpatel

Reputation: 184

Take this for an example:

 <?php
// insert some data using a prepared statement
$stmt = $dbh->prepare("insert into test (name, value) values (:name, :value)");
// bind php variables to the named placeholders in the query
// they are both strings that will not be more than 64 chars long
$stmt->bindParam(':name', $name, PDO_PARAM_STR, 64);
$stmt->bindParam(':value', $value, PDO_PARAM_STR, 64);
// insert a record
$name = 'Foo';
$value = 'Bar';
$stmt->execute();
// and another
$name = 'Fu';
$value = 'Ba';
$stmt->execute();
// more if you like, but we're done
$stmt = null;
?>

You just wrote a string in your above code:

    $sql="INSERT INTO review (username, movie_name, ratings) VALUES ("$_POST['username']","$_POST['moviename']","$_POST['ratings']")";

Upvotes: 2

rollsappletree
rollsappletree

Reputation: 630

A couple of errors:

1) you have to concat the strings! like this:

$sql="INSERT INTO review (username, movie_name, ratings) 
                 VALUES (".$_POST['username'].",".$_POST['moviename'].",".$_POST['ratings'].")";

2) you are not using the PDO at all: after you create the "insert" string you must query the db itself, something like using 

$conn->query($sql);

nb: it is pseudocode

3) the main problem is that this approach is wrong. constructing the queries in this way lead to many security problems. Eg: what if I put "moviename" as "; drop table review;" ??? It will destroy your db. So my advice is to use prepared statement: 

$sql="INSERT INTO review (username, movie_name, ratings) 
                 VALUES (?,?,?)";
$q = $conn->prepare($sql);
$fill_array = array($_POST['username'], $_POST['moviename'], $_POST['ratings']);
$q->execute($fill_array);

Upvotes: 1

Yalamber
Yalamber

Reputation: 7580

Above answers are correct, you will need to concat the strings to form a valid sql query. you can echo your $sql variable to check what is to be executed and if is valid sql query or not. you might want to look in to escaping variables you will be using in your sql queries else your app will be vulnerable to sql injections attacks.

look in to

http://php.net/manual/en/pdo.quote.php

http://www.php.net/manual/en/pdo.prepare.php

Also you will need to query you prepared sql statement.

look in to http://www.php.net/manual/en/pdo.query.php

Upvotes: 1

MSadura
MSadura

Reputation: 1042

You forgot dots:

$sql="INSERT INTO review (username, movie_name, ratings) 
                 VALUES (".$_POST['username'].",".$_POST['moviename'].",".$_POST['ratings'].")";

and fot the future for now your variables are not escaped so code is not secure

Upvotes: -1

Related Questions