The Shed is going Social! Join us on FaceBook and Twitter and chime in on the conversation.
|
 |
|
Dev Shed Forums
> Programming Languages
> PHP Development
|
PHP-General - Php - Sql Help
Discuss Php - Sql Help in the PHP Development forum on Dev Shed. Php - Sql Help PHP Development forum discussing coding practices, tips on PHP, and other PHP-related topics. PHP is an open source scripting language that has taken the web development industry by storm.
|
|
 |
|
|
|
|

Dev Shed Forums Sponsor:
|
|
|

November 28th, 2012, 04:07 AM
|
|
Registered User
|
|
Join Date: Nov 2012
Posts: 1
Time spent in forums: 9 m 20 sec
Reputation Power: 0
|
|
|
PHP-General - Php - Sql Help
HI guys
i really need some help can anyone tell me whats wrong with the code below, it can connect to the database but not insert customer
================================
<html>
<head>
<title>Scotia Cruises registration</title>
</head>
<body>
<h1>Member Registration</h1>
<?php
/* example line below should be
$FirstName = $_POST['customer_forename'];
*/
$Title = $_POST['customer_title'];
$FirstName = $_POST['customer_forename'];
$SecondName = $_POST['customer_surname'];
$AddressLine1 = $_POST['customer_address_1'];
$AddressLine2 = $_POST['customer_address_2'];
$Town = $_POST['customer_town'];
$Postcode = $_POST['customer_postcode'];
$Age = $_POST['customer_age'];
$Country = $_POST['customer_country'];
$TelephoneNumber = $_POST['customer_telephone_number'];
$Email = $_POST['customer_email'];
$Password = $_POST['customer_password'];
@ $db = mysql_connect('sql.comp-degree.uhi.ac.uk', '*********', '*********');
if (!$db)
{
echo 'Error: Could not connect to database. Please try again later.';
exit;
}
else
{
mysql_select_db('Siddique');
/* query values should be $title, $FirstName, $SecondName etc
so for example:
insert into 'customer'('customer_title','customer_forename') values ($title,$FirstName)
*/
$query = "insert into customer('customer_title','customer_forename','customer_surname','customer_address_1','customer_addr ess_2','customer_town','customer_postcode','customer_age','customer_country','customer_telephone_num ber','customer_email','customer_password','userlevel') values ($customer_title,$customer_forename,$customer_surname,$customer_address_1,$customer_address_2,$custo mer_town,$customer_postcode,$customer_age,$customer_country,$customer_telephone_number,$customer_ema il,$customer_password,user)";
$result = mysql_query($query);
if ($result)
echo 'Member inserted';
else
echo 'Did not work';
}
?>
<p>Click <a href="Manage_account.html">here</a> to return to the login page</font></p>
</body>
</html>
|

November 28th, 2012, 04:51 AM
|
 |
pollyanna
|
|
Join Date: Jul 2012
Location: Germany
|
|
Hi,
for the next time, please do some basic debugging yourself: output the query, execute it in phpmyadmin and see what error message you get. If you can't figure it out yourself, post all this data here in the forum.
Your query is not valid SQL, because you cannot wrap identifiers (table names, column names etc.) in single quotes. You can and must do that with values. So it's exactly the other way round in your INSERT query.
Apart from that, your code is wide open to SQL injections, because you simply dump the POST values into the query string. Anybody could manipulate the query in any way.
|
Developer Shed Advertisers and Affiliates
| Thread Tools |
Search this Thread |
|
|
|
| Display Modes |
Rate This Thread |
Linear Mode
|
|
Posting Rules
|
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
HTML code is Off
|
|
|
|
|