Can not insert data into mysql database with php

Question

I am having trouble inserting data to my table via PHP. The "cc_connect.php" is the file that connects the database. The form is there but when I submit it, no data is added to my table. I've followed several tutorials and matched their methods without success. Is something not set up in my db?

the function $dbcon is associated with my connection

<form method="post" action="cc_registration.php">
<input type="hidden" name="submitted" value="true" />

    First Name: <input type="text" name="first_name" />
    Last Name: <input type="text" name="last_name" />

<br />
<input type="submit" value="submit" />

  <?php

   if(isset($_POST['submit'])) {

   include ('cc_connect.php');

   if (!$dbcon) {

   die("Can not Connect: " . mysql_error());

}

   mysql_select_db("cooperstown",$dbcon);

$sql = "INSERT INTO cobra_registration (first_name,last_name) VALUES ('$_POST[first_name]', '$_POST[last_name]')";

mysql_query($sql,$dbcon);



mysql_close($dbcon);

}

  ?>

$sql = "INSERT INTO cobra_registration (first_name,last_name) VALUES --- You haven't sent any values... — DanDotNet
– DanDotNet, Commented Jul 10, 2014 at 21:16
Doesn't answer the question, but this is wide open to SQL Injection attacks. — Matthew Johnson
– Matthew Johnson, Commented Jul 10, 2014 at 21:17
ok, VALUES? where are the values you passing to the statement?, needs to be something like this, VALUES( value i am trying to pass, value i am trying to pass), also please go read about sql injection and try to prevent it in your code — dansasu11
– dansasu11, Commented Jul 10, 2014 at 21:17
the values are inserted from the form 'first_name', 'last_name'... for some reason, if I change the "if(isset($_POST['submit']));" to "if($_POST);", I can add information. not sure why that is. — jd5
– jd5, Commented Jul 10, 2014 at 21:19

GGio · Accepted Answer · 2014-07-10 21:28:20Z

3

$_POST['submit'] is never set because you are passing submitted.

change:

<input type="hidden" name="submitted" value="true" />

to:

<input type="hidden" name="submit" value="true" />

As a side note your current query can easily be hacked. Use Prepared statements instead like PDO or MysQLi, here is an example in PDO:

$fName = isset($_POST['first_name']) ? $_POST['first_name'] : '';
$lName = isset($_POST['last_name']) ? $_POST['last_name'] : '';

if ($fName && $lName) {
   $stmt = $db->prepare('
      INSERT INTO cobra_registration (first_name,last_name) 
      VALUES (:fname, :lname)
   ');

   $stmt->bindParam(':fname', $fName, PDO::PARAM_STR);
   $stmt->bindParam(':lname', $lName, PDO::PARAM_STR);

   $res = $stmt->execute();

   if ($res) {
      echo 'Success';
   } else {
      echo 'Failure';
   }
}

edited Jul 10, 2014 at 21:28

answered Jul 10, 2014 at 21:22

GGio

7,67311 gold badges48 silver badges85 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Matthew Johnson Over a year ago

I missed the submitted, good catch! However, he should be getting errors with that insert statement. +1

jd5 Over a year ago

good grief!!! thanks. changed the isset to isset($_Post['submitted'] and it is working!!!

VMai Over a year ago

@jd5 If it solved your problem, please mark it as answer. Then this question will be off the "Unanswered question" list.

Community · Accepted Answer · 2023-11-17 20:38:18Z

2

The mysql_* functions are deprecated, and should no longer be used. Look into mysqli or PDO.

IMPORTANT NOTE

This is WIDE open to SQL Injection attacks. You should use prepared statements to protect against such attacks.

GGio nailed his answer, it was the submitted, but checking for submit. He also provided a PDO example, so I'll demonstrate the same thing in mysqli:

$firstName = isset($_POST['first_name']) ? $_POST['first_name'] : '';
$lastName = isset($_POST['last_name']) ? $_POST['last_name'] : '';

if ($firstName && $lastName) {
    $stmt = $mysqli->prepare("INSERT INTO cobra_registration (first_name,last_name) 
  VALUES (?, ?)"); 
    $stmt->bind_param("ss", $firstName, $lastName);
    $stmt->execute();  

}

edited Nov 17, 2023 at 20:38

CommunityBot

11 silver badge

answered Jul 10, 2014 at 21:24

Matthew Johnson

5,2152 gold badges42 silver badges53 bronze badges

14 Comments

Matthew Johnson Over a year ago

@VMai His version is missing the single quote around the post variable name. He has $_POST[first_name], whereas it should be $_POST['first_name'], GGio has it though, the submitted` isn't checked correctly.

VMai Over a year ago

Inside of double quotes you don't have to quote a string as key of an array: "$_POST[first_name]" is perfectly valid PHP, even if I don't use this.

Matthew Johnson Over a year ago

So it is! Just got through testing that, thanks for teaching me something new! I'll be deleting the answer shortly.

VMai Over a year ago

Edit your answer. I see no need to delete it. The most important part holds true: "This is WIDE open to SQL Injection attacks ...". This should be repeated as often as possible, if such code appears. And learning by answering and getting corrected is great. Especially by testing by yourself and not believing everything any other said.

VMai Over a year ago

I saw it, remove my first comment that wasn't relevant anymore and gave you +1. You both deserved it.

|

Collectives™ on Stack Overflow

Can not insert data into mysql database with php

2 Answers 2

3 Comments

14 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

14 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related