DaniWeb Forum Index > Web Development > PHP

please tell me what is wrong with the code?

Please support our PHP advertiser: PostgreSQL or MySQL? Compare and contrast the two most popular open source databases

•

Join Date: Feb 2008

Posts: 15

Reputation: niladri.user is an unknown quantity at this point

Solved Threads: 0

niladri.user niladri.user is offline

Offline

Newbie Poster

please tell me what is wrong with the code?

Feb 11th, 2008

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>Untitled Document</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>

<body>
<?php
echo"Your posted name is\t".$_POST['name'];
echo"Your posted roll is\t".$_POST['roll'];
?>
<?php
$con=mysql_connect("localhost","root","");
if(!$con)
{
die("could not connect:".mysql_error($con));
}
mysql_select_db("form",$con);
mysql_query("insert into submit values('$_POST['name']','$_POST['roll']')");
echo"1 record added";
mysql_close($con);
?>
</body>
</html>
error is showing on that line..........

•

Join Date: Feb 2008

Posts: 6

Reputation: fenixZ is an unknown quantity at this point

Solved Threads: 1

fenixZ

Offline

Newbie Poster

Re: please tell me what is wrong with the code?

Feb 11th, 2008

See there are some wrong thing in security with your code but now I am going to tell you syntax errors only (cause security is very deep....)

mysql_query("insert into submit values('$_POST['name']','$_POST['roll']')");

must evaluate into:
mysql_query("insert into submit(name,roll) values('$_POST['name']','$_POST['roll']')");

after name of table you have to put name of column also!

•

Join Date: Jan 2008

Posts: 57

Reputation: Walkere is an unknown quantity at this point

Solved Threads: 5

Walkere

Offline

Junior Poster in Training

Re: please tell me what is wrong with the code?

Feb 11th, 2008

•

Originally Posted by fenixZ

See there are some wrong thing in security with your code but now I am going to tell you syntax errors only (cause security is very deep....)

What he's trying to say, is you should never insert user input directly into the database. There are a number of ways a malicious user can use that type of insert statement to hack into your database and screw things up.

Instead, you should always validate the input to make sure that it won't harm your database.

The easiest way to clean code for use in a mysql query is to use the "mysql_real_escape_string()" function.

Like so...

 Help with Code Tags 
 php Syntax (Toggle Plain Text) 
$name = mysql_real_escape_string($_POST['name']);
$roll = mysql_real_escape_string($_POST['roll']);
 
//  Create mysql query, using $name and $roll
$name = mysql_real_escape_string($_POST['name']);
$roll = mysql_real_escape_string($_POST['roll']);

//  Create mysql query, using $name and $roll

Incidentally, this may also be causing another error for you. You can't include an array value (like $_POST['name']) directly inside of a string. You need to either wrap the entire array variable in brackets {} or reference the variable outside the quotes using a string concatenation.

For example...

 Help with Code Tags 
 php Syntax (Toggle Plain Text) 
$query = "insert into submit(name,roll) values('{$_POST['name']}','{$_POST['roll']}')";
//  Or...
$query = "insert into submit (name, roll) values ('" . $_POST['name'] . "', '" . $_POST['roll'] . "')";
$query = "insert into submit(name,roll) values('{$_POST['name']}','{$_POST['roll']}')";
//  Or...
$query = "insert into submit (name, roll) values ('" . $_POST['name'] . "', '" . $_POST['roll'] . "')";

- Walkere

Thoughts on Education and Technology
PHP Tutorials, Web Design Tips, and More...

•

Join Date: Nov 2007

Posts: 3,749

Reputation: nav33n is a jewel in the rough

Solved Threads: 331

nav33n

Offline

Senior Poster

Re: please tell me what is wrong with the code?

Feb 11th, 2008

•

Originally Posted by niladri.user

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>Untitled Document</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>

<body>
<?php
echo"Your posted name is\t".$_POST['name'];
echo"Your posted roll is\t".$_POST['roll'];
?>
<?php
$con=mysql_connect("localhost","root","");
if(!$con)
{
die("could not connect:".mysql_error($con));
}
mysql_select_db("form",$con);
mysql_query("insert into submit values('$_POST['name']','$_POST['roll']')");
echo"1 record added";
mysql_close($con);
?>
</body>
</html>
error is showing on that line..........

The error is with the parsing of quotes. Instead, use

 Help with Code Tags 
 php Syntax (Toggle Plain Text) 
$name=$_POST['name'];
$roll=$_POST['roll'];
mysql_query("insert into submit (col1,col2) values ('$name','$roll')");
$name=$_POST['name'];
$roll=$_POST['roll'];
mysql_query("insert into submit (col1,col2) values ('$name','$roll')");