CODEWITHSUNDEEP
phpmysql
Ajay Shah
Ajay Shah

Reputation: 95

PHP and MySQL insert successful but can't see that the row has been inserted in PHPMyAdmin

I have a simple registration form that inserts data into MySQL table. I am checking for error as well but it results in SUCCESS echo. On Stackoverflow, I looked for the question, but couldn't really find an answer pertaining to my situation. Please forgive me if it has been answered. If it has been answered already, please provide a link and I will apologize for wasting anybody's time. Thank you! Below is my code:

<?php
if($_GET["regname"] && $_GET["regpass1"] && $_GET["regpass2"])
{
if($_GET["regpass1"]==$_GET["regpass2"])
{
$servername="localhost";
$username="root";
$password='';
$conn= mysql_connect($servername,$username,$password)or die(mysql_error());
mysql_select_db("test")or die("cannot select DB");
$sql="INSERT INTO members('id','username','password')VALUES('DEFAULT','$_GET[regname]','$_GET[regpass1]')";

if($sql)
{
echo "Success";

}
else
{
echo "Error";

}

print "<h1>you have registered sucessfully</h1>";

print "<a href='main_login.php'>go to login page</a>";
}
else print "passwords doesnt match";
}
else print"invaild data";
?>

Upvotes: 0

Views: 4802

Answers (2)

Vaviloff
Vaviloff

Reputation: 16846

Look at these lines:

$sql="INSERT INTO members('id','username','password')VALUES('DEFAULT','$_GET[regname]','$_GET[regpass1]')";

if($sql)
{
    echo "Success";
}

You have created a request in $sql variable but have not executed it. The variable itself is non-empty, non-false so it evaluates to TRUE in the if-condition.

You should do it like this:

$sql="INSERT INTO members('id','username','password')VALUES('DEFAULT','$_GET[regname]','$_GET[regpass1]')";

$result = mysql_query($sql);

if (!$result) 
{
    die('Invalid query: ' . mysql_error());
}
else
{
    echo "Success";
}

Just to be on the safe side I'll note that using variables from $_GET request like this, unfiltered, is an inapprorpiate tactic as it will lead to SQL injections, but I suppose you simplified code sample for the sake of brevity.

Upvotes: 1

Brandon White
Brandon White

Reputation: 1005

You are checking if $sql exists. $sql is your actual query string. In this case, of course it will show it exists. Secondly, please do not use mysql_* for new code as it is deprecated. Instead use mysqli_* or PDO.

You actually haven't executed your query in your code. (Using deprecated mysql_* which is ill advised) the code as follows should execute the query:

$result = mysql_query($sql, $conn);
if($result == true)
    echo 'Success';
else
    echo 'Failure';

Instead of using the code above, I would strongly recommend updating your current code to use mysqli_* or PDO forms. You can read up more on this topic at the manpages linked previously.

Upvotes: 4

Related Questions