Insert data into mysql database

Question

Im trying to insert data into my mysql databse. It succesfully inserts the data but the problem is everytime i load the page i recieve the following error.

   Notice: Undefined index: comment in 
   C:\wamp\www\CMS\addnews.php on line 42
   Call Stack
   #    Time    Memory  Function    Location
   1    0.0004  674184  {main}( )   ..\addnews.php:0

Im aware that the mysql extension is offically depreciated so please dont comment on that.

Here's my code

               <form id="insNews" name="insNews" method="POST" action="addnews.php">


                           <textarea rows="20" cols="90" name="comment"></textarea>
                           <input type="submit" name="InsertNews" id="InsertNews">
                       <?php
                          include 'db.php';
                          $comment=$_POST['comment']; // **ERROR HERE**
                          $tablename="news";
                          $sql="INSERT INTO $tablename(news_content)VALUES('$comment')";

                             if(isset($_POST['InsertNews'])) 
                             {
                             mysql_query($sql);
                            }

                      ?>

You are using [an **obsolete** database API](http://stackoverflow.com/q/12859942/19068) and should use a [modern replacement](http://php.net/manual/en/mysqlinfo.api.choosing.php). You are also **vulnerable to [SQL injection attacks](http://bobby-tables.com/)** that a modern API would make it easier to [defend](http://stackoverflow.com/questions/60174/best-way-to-prevent-sql-injection-in-php) yourself from. — Quentin, Mar 18 '13 at 12:37

score 2 · Answer 1 · edited May 25 '19 at 14:25

This means $_POST['comment'] has not been defined. In other words, a value for the field named comment has not been submitted by your form.

So you either:

Need to throw an error to your user and tell them comment is a required field and make sure a value is provided before submitting it to the database
Check to see if there is a value before assigning it to a variable. And if there is not, assign a default value.

FYI, Please, don't use mysql_* functions in new code. They are no longer maintained and are officially deprecated. See the red box? Learn about prepared statements instead, and use PDO, or MySQLi - this article will help you decide which. If you choose PDO, here is a good tutorial.

You also wide open to SQL injections

score 1 · Answer 2 · answered Mar 18 '13 at 12:37

You appear to be trying to read data from your form when you generate the HTML document containing the form.

Since the form won't have been submitted at this time, the data won't be there.

You can either:

Move your form processing to a different script and set the URI for that script in the action
Branch your logic within the existing script. Test to see if the request method was POST, then decide if you want to process the form data and/or display the form based on that.

Either way, test to see if the array keys exist before trying to read them. If they don't, provide your own error state rather then checking a raw PHP error at the user.

Arun Unnikrishnan · Answer 3 · 2013-03-18T12:43:20.250

1

you will have to check if $_POST['comment'] is successful and then execute the query

if isset($_POST['comment']){
$comment=$_POST['comment'];
$tablename="news";
$sql="INSERT INTO $tablename(news_content)VALUES('$comment')";

     mysql_query($sql);

}

edited Mar 18 '13 at 12:43

answered Mar 18 '13 at 12:37

Arun Unnikrishnan

2,339
2
25
39

score 0 · Accepted Answer · answered Mar 18 '13 at 12:38

You must check if variable exists.

<form id="insNews" name="insNews" method="POST" action="addnews.php">
    <textarea rows="20" cols="90" name="comment"></textarea>
    <input type="submit" name="InsertNews" id="InsertNews">
</form>

<?php
include 'db.php';
if (!empty($_POST['comment'])) {
    $comment   = $_POST['comment']; // **ERROR HERE**
    $tablename = "news";
    $sql="INSERT INTO $tablename(news_content)VALUES('" . mysql_real_escape_string($comment) . "')";

    if(isset($_POST['InsertNews'])) 
    {
        mysql_query($sql);
    }
}

?>

But I want to inform you that mysql_* lib is deprecated. Use PDO or mysqli instead this. Also, be care about Sql injection, if you want to use mysql_* functions, use mysql_real_escape_string.

if (!empty($_POST['comment'])) Does it mean that it wont insert the data if the textarea is empty? — Dynamiite, Mar 18 '13 at 12:45
Yes, empty function check if data is `""` (an empty string), `0` (0 as an integer), `0.0` (0 as a float), `"0"` (0 as a string), `NULL`, `FALSE`, `array()` (an empty array), `$var;` (a variable declared, but without a value) ` — GoT, Mar 18 '13 at 12:54

Insert data into mysql database

4 Answers4