CODEWITHSUNDEEP
php
shekhar
shekhar

Reputation: 11

Error querying database in php script

i m trying to insert some data from form and it is giving error every time "error querying database" my coding is this

<?php
 $dbc = mysqli_connect('localhost', 'root', '', 'askquestion')
    or die('Error connecting to MySQL server.');   

   $first_name=$_POST['firstname'];
   $last_name=$_POST['lastname'];
   $email=$_POST['email'];
   $password=$_POST['password'];
   $state=$_POST['state'];
   $city=$_POST['city'];
   $category=$_POST['category'];


    $query = "INSERT INTO signup (first_name, last_name, email, password, state, city, category)  VALUES ('$first_name', '$last_name', $email, $password, $state, $city, $category)";

    $result=mysqli_query($dbc, $query) or die('Error querying database.'). mysql_error();;


    echo 'you are registered...!';

   mysqli_close($dbc);


   ?>

Upvotes: 1

Views: 396

Answers (3)

dgamma3
dgamma3

Reputation: 2371

when inserting values into a database you need quotes around the variables or values which are strings, you don't need quotes around integers/floats or numbers.

All the values you are getting from the POST super global are strings of text, i would assume. therefore replace this: (check your table structure if this doesn't work):

$query = "INSERT INTO signup (first_name, last_name, email, password, state, city, category)  VALUES ('$first_name', '$last_name', $email, $password, $state, $city, $category)";

with this:

$query = "INSERT INTO signup (first_name, last_name, email, password, state, city, category) VALUES ('$first_name', '$last_name', '$email', '$password', '$state', '$city', '$category')";

for more information, read here: http://www.w3schools.com/sql/sql_insert.asp

Upvotes: 0

bear
bear

Reputation: 11605

Have a look at your query, you have

'$last_name', $email, $password, $state, $city, $category)

Whereas you should have:

$query = "INSERT INTO signup (first_name, last_name, email, password, state, city, category)  VALUES ('$first_name', '$last_name', '$email', '$password', '$state', '$city', '$category')";

Also, try to use 

die(mysql_error());

in development

For SQL security, you should always escape each input value:

$first_name=mysql_real_escape_string($_POST['firstname']);

Upvotes: 0

AJ.
AJ.

Reputation: 28174

You're vulnerable to SQL Injection attacks. Always escape your incoming POST values, using mysql_real_escape_string(). This helps to prevent SQL injection, and it ensures that all values being used in your query statement that have special characters are escaped properly (e.g. quotes).

Additionally, make sure all string values are properly wrapped in quotes in your VALUES statement.

Upvotes: 1

Related Questions