CODEWITHSUNDEEP
phpmysql
user3533863
user3533863

Reputation: 5

MySQL - PHP form to insert values into table?

I would like to add comments to a database using a simple form. For whatever reason, I can't seem to get the table to update when I use said form. I'm not getting any errors, it's just that nothing happens when I refresh the table afterwards. In other words, even after submitting the form, the table still has 0 entries. Here is my code:

<?php
session_start();
$connection = mysql_connect("server", "username", "password");
if ($connection->connect_error) {
    die('Connect Error: ' . $connection->connect_error);
}
// Selecting Database
mysql_select_db("database", $connection) or die(mysql_error());

$name = $_POST['name'];
$title = $_POST['title'];
$comments = $_POST['comments'];

$sql = "INSERT INTO comments (Name, Title, Comments)
VALUES ('$name', '$title', '$comments')";

mysql_close($connection); // Closing Connection

?>

Thank you for your help!

Upvotes: 0

Views: 60

Answers (2)

Alireza Mirhabibi - IRAN
Alireza Mirhabibi - IRAN

Reputation: 70

(note: please change server, username, and password for your server information)

 <?php
    session_start();
    $connection = mysql_connect("server","username","password");
    if (!$connection) {
        die('Connect Error: ' . mysql_error());
    }
    // Selecting Database
    mysql_select_db("database",$connection) or die(mysql_error());

    $name = $_POST['name'];
    $title = $_POST['title'];
    $comments = $_POST['comments'];

    $sql = "INSERT INTO comments (Name,Title,Comments)
    VALUES ('$name', '$title', '$comments')";

    mysql_query($sql);
    mysql_close($connection); // Closing Connection

    ?>

For security (defense against SQL injection) you can using mysql_real_escape_string function for limit input fields. For example:

$name = mysql_real_escape_string($_POST['name']);
$title = mysql_real_escape_string($_POST['title']);
$comments = mysql_real_escape_string($_POST['comments']);

Upvotes: 0

John Conde
John Conde

Reputation: 219814

You don't ever actually execute your query:

$sql = "INSERT INTO comments (Name, Title, Comments)
VALUES ('$name', '$title', '$comments')";
$result = mysql_query($sql);

Other things:

  1. if ($connection->connect_error) { is not valid. You can't use the old mysql API in an OOP fashion. You need to use mysqli for that.

  2. Please, don't use mysql_* functions in new code. They are no longer maintained and are officially deprecated. See the red box? Learn about prepared statements instead, and use PDO or MySQLi - this article will help you decide which. If you choose PDO, here is a good tutorial.

  3. You are also wide open to SQL injections

  4. You do no error checking. How do you expect to know if there are problems if you don't look for them?

Upvotes: 4

Related Questions