CODEWITHSUNDEEP
javascriptphphtmlmysql
Utpal Paul
Utpal Paul

Reputation: 23

MYSQL data insert query is not working

I want to insert some data from a form to a database table "sumation". But it's not working. I use PhpStorm IDE and it's shows no data sources are configured to run this sql and sql dialect is not configured. Where is the problem ?

<?php
    $db= new PDO('mysql:host=localhost;dbname=test;cahrset=utf8','root','');
    if(isset($_POST['submit'])){
        $id=$_POST['id'];
        $first=$_POST['first'];
        $second=$_POST['second'];
        $third=$_POST['third'];

        $sql="INSERT INTO sumation VALUES($id,'$first','$second','$third')";
        $db->query($sql);
        echo("<script>alert('Data Inserted Sucessfully !')</script>");
    }

?>
<!doctype html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Document</title>
</head>
<body>
    <form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post">
        ID: <input type="text" name="id"><br>
        First: <input type="text" name="first"><br>
        Second: <input type="text" name="second"><br>
        Third: <input type="text" name="third"><br>
        <button type="submit" class="btn-primary" name="submit">Insert </button>
    </form>

</body>
</html>

Upvotes: 0

Views: 286

Answers (4)

Parsa
Parsa

Reputation: 3236

To properly answer your question on how to protect your application from SQL injection attacks.

An SQL injection attack is where a user inserts SQL commands into their input string allowing them to run SQL queries on your database. This means they can drop the whole database or print out all the rows.

You can use the PDO quote function.

$id=$db->quote($_POST['id']);
$first=$db->quote($_POST['first']);
$second=$db->quote($_POST['second']);
$third=$db->quote($_POST['third']);

Alternatively I would recommend you use PDO prepare and execute functions read documentation here: http://php.net/manual/en/pdo.prepare.php

Upvotes: 0

Qirel
Qirel

Reputation: 26450

Your query is wrong, the syntax of INSERT is 

INSERT INTO table_name (column1, column2, column3,...) VALUES (value1, value2, value3,...)

So your query would look like

INSERT INTO sumation (id, first, second, third) VALUES ($id, '$first', '$second', '$third')

You also just assume that your query is executed. A PDO query would return an object on success, and boolean false on failure, meaning that you could wrap it into an if-statement.

You should also read up on How can I prevent SQL-injection in PHP?, which basically means that you should use prepared statements.

Upvotes: 1

pavlovich
pavlovich

Reputation: 1942

This should work: 

<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

    $id=$_POST['id'];
    $first=$_POST['first'];
    $second=$_POST['second'];
    $third=$_POST['third'];

    $conn = new mysqli('localhost', 'root', '', 'test');
    // Check connection
    if ($conn->connect_error) {
        die("Connection failed: " . $conn->connect_error);
    }

    $sql="INSERT INTO sumation (id,first,second,third) VALUES ($id,'$first','$second','$third')";

    if ($conn->query($sql) === TRUE) {
        echo("<script>alert('Data Inserted Sucessfully !')</script>");
    } else {
        echo "Error: " . $sql . "<br>" . $conn->error;
    }
}
?>

<!doctype html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Document</title>
</head>
<body>
<form method="post">
    ID: <input type="text" name="id"><br>
    First: <input type="text" name="first"><br>
    Second: <input type="text" name="second"><br>
    Third: <input type="text" name="third"><br>
    <button type="submit" class="btn-primary" name="submit">Insert </button>
</form>

</body>
</html>

Upvotes: 0

fool-dev
fool-dev

Reputation: 7777

Please try

$sql="INSERT INTO sumation VALUES($id,'$first','$second','$third')";

Just replace

$sql="INSERT INTO sumation (id,first,second,third) VALUES ($id,'$first','$second','$third')";

Upvotes: 0

Related Questions