Hey I am trying to make a page that inserts some strings into a MySQL table but it just dosn't seem to be working for me. Here is the code I am using at the moment.
<?php
mysql_connect($address, $username, $password);
@mysql_select_db($database) or die("Unable to select database");
$query = "insert INTO user (movieid, moviename)('" . $id . "','" . $name . "') or die(mysql_error())";
mysql_query($query);
mysql_close();
?>
Where am i going wrong?
There should be no die() at all, but trigger_error() instead.
And data must be properly formatted for the query:
<?php
mysql_connect($address, $username, $password);
mysql_select_db($database);
$id = mysql_real_escape_string($id);
$name = mysql_real_escape_string($name);
$query = "insert INTO user (movieid, moviename) VALUES ('$id','$name')";
mysql_query($query) or trigger_error((mysql_error().$query);
?>
Always do any mysql job this way
or die in the wrong place.The query should just be this:
"INSERT INTO user (movieid, moviename) VALUES ('" . $id . "','" . $name . "')";
The or die should come after the call to mysql_query.
You may also have an SQL injection vulnerability. Consider using mysql_real_escape_string.
Like this:
$query = "INSERT INTO user (movieid, moviename) VALUES ('" . $id . "','" . $name . "')";
mysql_query($query) or die(mysql_error());
