CODEWITHSUNDEEP
phphtmlmysql
Soumya
Soumya

Reputation: 146

PHP & MySQL - not inserting into database

I've got an problem in my code. The insert is not working. The code is below.

HTML:

<form action="staff.php" method="post" class="center" enctype="multipart/form-data" autocomplete="off">
    <input type="hidden" name="size" value="1000000">
    <input type="text" placeholder="headline of the news" name="title">
    <input type="file" accept="image/*" name="image">
    <select name="side" value="side">
        <option>Left</option>
        <option>Header</option>
        <option>Main</option>
        <option>Ending</option>
    </select>
    <textarea name="desc" id="description" cols="30" rows="10" placeholder="full news" name="desc"></textarea>
    <input type="submit" name="go" value="Post">
</form>

PHP:

<?php
$db = mysqli_connect("DB SERVER", "DB USER", "DB PASS", "DataBase");
$charset = mysqli_set_charset($db,"utf8");
$msg = "";
if (isset($_POST['go'])) {
    $target = "images/".basename($_FILES['image']['name']);
    $title = $_POST['title'];
    $image = $_FILES['image']['name'];
    $side = $_POST['side'];
    $desc = $_POST['desc'];
    $sql = "INSERT INTO contents (title, image, side, description) 
    VALUES ('$title', '$image', '$side', '$desc')";
    $result = mysqli_query($db, $sql);
    if (move_uploaded_file($_FILES['image']['tmp_name'], $target)) {
        $msg = "<p class='success'>Image uploaded successfully</p>";
    } else {
        $msg = "<p class='error'>There was a problem uploading the image</p>";
    }
}
?>

Everything is fine except the inserting into database.

Upvotes: 1

Views: 1673

Answers (5)

Gyan
Gyan

Reputation: 508

Use as

<?php
$db = mysqli_connect("DB SERVER", "DB USER", "DB PASS", "DataBase") or die(mysqli_error("Could not connect to Database"));
mysqli_query($db,"SET NAMES 'utf8'");
$msg = "";
if (isset($_POST['go'])) {
    $target = "images/".basename($_FILES['image']['name']);

    $title = mysqli_real_escape_string($db,$_POST['title']);
    $image = mysqli_real_escape_string($db,$_FILES['image']['name']);
    $side = mysqli_real_escape_string($db,$_POST['side']);
    $desc = mysqli_real_escape_string($db,$_POST['desc']);
    $sql = "INSERT INTO contents (title, image, side, description) 
    VALUES ('$title', '$image', '$side', '$desc')";
    $result = mysqli_query($db,$sql) or die(mysqli_error($db));
    if (move_uploaded_file($_FILES['image']['tmp_name'], $target)) {
       $msg = "<p class='success'>Image uploaded successfully</p>";
    }else{
       $msg = "<p class='error'>There was a problem uploading the image</p>";
    }
}
?>

Upvotes: 1

Nica
Nica

Reputation: 175

$sql = "INSERT INTO contents VALUES ('".$title."', '".$image."', '".$side."', '".$desc."')";

This could be a shorter way.

Upvotes: 1

Ultrazz008
Ultrazz008

Reputation: 1688

Your query is fine, it should work.

But you're allowing SQL injections, so if you send within parameter single quotes your query will not work as expected and will throw out an error...

You should first:

Upvotes: 1

Kunal Awasthi
Kunal Awasthi

Reputation: 320

$sql = "INSERT INTO contents (title, image, side, description) VALUES ('".$title."', '".$image."', '".$side."', '".$desc."')";

The problem is here use this.

Upvotes: 0

Bilal Ahmed
Bilal Ahmed

Reputation: 4076

add concatenation in the query like this

$sql = "INSERT INTO contents (title, image, side, description) 
        VALUES ('".$title."', '".$image."', '".$side."', '".$desc."')";

Upvotes: 2

Related Questions