PHP Development
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me
Go Back   Dev Shed ForumsProgramming LanguagesPHP Development

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
  #1  
Old June 30th, 2009, 04:15 PM
mamut0o1 mamut0o1 is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
 
Join Date: Jul 2008
Posts: 25 mamut0o1 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 7 h 2 m 46 sec
Reputation Power: 0
Mysql Database not working>?

Hello; I'm a newbie at Mysql and I need your help. I'm creating a database with a table. Inside my table I have 7 fileds. I'm able to see the database when I do SHOW DATABASES; I see the table is there as well.
In PHP i wrote a script to connect to the database as below:
[code]
</style>
<form action="insert.php" method="post">
First Name <input type="text" name="first"><br>
Last Name <input type="text" name="last"><br>
E-mail <input type="text" name="mail"><br>
Fax <input type="text" name="fax"><br>
Tel <input type="text" name="tel"><br>
Company <input type="text" name="company"><br>
<input type="submit" name="Send"><br>
</form>

<?
$user="root";
$password="xxxxxxxxxxxxx";
$database="mydatabasename";

$first=$_POST['first']
$last=$_POST['last']
$mail=$_POST['mail']
$fax=$_POST['fax']
$tel=$_POST['tel']
$company=$_POST['company']

mysql_connect(localhost,$user,$password);
@mysql_select_db($database) or die("unable to select database");

$query= 'INSERT INTO contacts VALUES (",'$first','$last','$mail','$fax','$tel','$company')";
mysql_query($query);

mysql_close();
?>

I have a "wamp" setup so I go to "localhost/insert.php" to view this file; I fill out the information and press submit and nothing happens... I changed the password to see if I get "unable to connect" error and nothing happens.
Can someone please help me.

Thanks in advance

Reply With Quote
  #2  
Old June 30th, 2009, 06:46 PM
fubes2000's Avatar
fubes2000 fubes2000 is offline
manwich
Dev Shed Newbie (0 - 499 posts)
 
Join Date: Oct 2003
Location: Canadanistan
Posts: 372 fubes2000 User rank is Captain (20000 - 30000 Reputation Level)fubes2000 User rank is Captain (20000 - 30000 Reputation Level)fubes2000 User rank is Captain (20000 - 30000 Reputation Level)fubes2000 User rank is Captain (20000 - 30000 Reputation Level)fubes2000 User rank is Captain (20000 - 30000 Reputation Level)fubes2000 User rank is Captain (20000 - 30000 Reputation Level)fubes2000 User rank is Captain (20000 - 30000 Reputation Level)fubes2000 User rank is Captain (20000 - 30000 Reputation Level)fubes2000 User rank is Captain (20000 - 30000 Reputation Level)  Folding Points: 154682 Folding Title: Super Ultimate Folder - Level 1Folding Points: 154682 Folding Title: Super Ultimate Folder - Level 1Folding Points: 154682 Folding Title: Super Ultimate Folder - Level 1Folding Points: 154682 Folding Title: Super Ultimate Folder - Level 1Folding Points: 154682 Folding Title: Super Ultimate Folder - Level 1Folding Points: 154682 Folding Title: Super Ultimate Folder - Level 1
Time spent in forums: 4 Days 8 h 22 m 38 sec
Reputation Power: 236
Three things, the first being your INSERT syntax is dependant on he version of mySQL you're running, only the most recent few versions allow your to skip specidying the column names, so long as the number and order are correct. The safest bet is to specify your column names explicitly, ie:
Code:
INSERT INTO contacts (id, first, last, mail, fax, tel, company) VALUES ('','$first','$last','$mail','$fax','$tel','$company')

The second issue is your PHP syntax for specifying the string is way out of whack, with mismatched quotes. Correcting what is written would yeild:
Code:
$query= "INSERT INTO contacts VALUES ('','$first','$last','$mail','$fax','$tel','$company')";

Thirdly, a more advanced issue, is your code is terribly insecure. You are not checking any of the form inputs to see if they are correct. For example, if I wanted to be a very mean person I would pull a "Johnny Tables" and fill in my first name as "John';DROP TABLE contacts;--". This essentially truncates your query and runs my code to drop the contacts table from your database, or pretty much anything I wanted.

To protect yourself from such shenanigans you should get in the habit of checking the form inputs when you are pulling them from the $_GET, $_POST, and $_REQUEST arrays. Enforce maximum lengths, strip out or replace special characters, check that numbers are numbers, etc.

Also, if you find a query is not doing what it is supposed to use the mysql_error() function to retrieve any error info that may have been generated by the last query.
http://us3.php.net/manual/en/function.mysql-error.php
__________________

Reply With Quote
  #3  
Old July 2nd, 2009, 11:33 AM
mamut0o1 mamut0o1 is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
 
Join Date: Jul 2008
Posts: 25 mamut0o1 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 7 h 2 m 46 sec
Reputation Power: 0
Thank you for your help; I think I will have to read up some more; I'm still having issues connecting to Mysql using PHP; i'm not sure if there anything else I have to tweak in the wamp settings.

Thanks
mamut

Reply With Quote
Reply

Viewing: Dev Shed ForumsProgramming LanguagesPHP Development > Mysql Database not working>?


Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump




 Free IT White Papers!
 
How to Present Effectively Online
This white paper offers practical and actionable advice on the key steps that any presenter should consider as they plan and execute a Webinar or online meeting.

 
Open Source Security Myths
Open Source Software (OSS) is computer software whose source code is available to the general public with relaxed or non-existent intellectual property restrictions (or arrangement such as the public domain), and is usually developed with the input of many contributors.

 
Power and Cooling Capacity Management for Data Centers
This paper describes the principles for achieving power and cooling capacity management.

 
Scalable, Fault-Tolerant NAS for Oracle - The Next Generation
For several years NAS has been evolving as a storage alternative for Oracle databases, and for good reason: NAS is quite often the simplest, most cost-effective storage approach for Oracle. Learn about the benefits that HP's approach to scalable NAS brings to Oracle environments in this comprehensive white paper.

 
Understanding Web Application Security Challenges
This white paper discusses many common threats and preventive measures for Web application security, and explains what you can do to help protect your organization.

 

Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 




© 2003-2009 by Developer Shed. All rights reserved. DS Cluster 3 Hosted by Hostway
Stay green...Green IT