$_POST error saving mysql database

Question

I have this code, this is to register a user from a link given from an email. so the ID and Email is being GET by the form and display, then being check if there is a user then it will display the contents on the field, then it is just an update. Now what I'm trying to do is to CREATE, since the ID in the link that is given to the user doesn't exist yet. This is the code in the file called Register.php

<?php

    load_function('database.php');

    if(!empty($_GET['user_id']) && !empty($_GET['cbemail'])) 
    {
        $user_id = base64_decode($_GET['user_id']);
        $email = base64_decode($_GET['cbemail']);   

        $employee = get_employee($user_id,$email);

    }

        /*$first_name = $_POST['first_name'];
        $middle_name = $_POST['middle_name'];
        $last_name = $_POST['last_name'];
        $suffix = $_POST['suffix'];
        $gender = $_POST['gender'];
        $date_birth = $_POST['date_birth'];
        $cbemail = $_POST['cbemail'];
        $locality_id = $_POST['locality_id'];
        $home_phone = $_POST['home_phone'];
        $mobile_phone = $_POST['mobile_phone'];*/

?>

<div id="main-content">
    <div id="emp_registrationform">
      <form action="" method="post">
        <table width="600" border="0">
        <h1>Create Employee</h1>
          <tr>
            <td class="align-right"><label for="user_id">User</label>
            <input type="text" name="user_id" id="user_id" 
             value="<?php if(isset($user_id)){echo $user_id ; } ?>"/></td>
            </td>
          </tr>
          <tr>
            <td class="align-right"><label for="first_name">First Name</label>
              <input type="text" name="first_name" id="first_name" value='<?php echo $employee['first_name'] ?>'/></td>
            <td><label for="birth_date">Birth Date</label>
              <input type="text" name="birth_date" id="birth_date" value='<?php echo $employee['date_birth'] ?>'/></td>
          </tr>
          <tr>
            <td class="align-right"><label for="middle_name">Middle Name</label>
              <input type="text" name="middle_name" id="middle_name" value='<?php echo $employee['middle_name'] ?>'/></td>
            <td><label for="cbemail">Email</label>
              <input type="text" name="cbemail" id="cbemail" 
               value="<?php if(isset($email)){echo $email ; } ?>"/></td>
          </tr>
          <tr>
            <td class="align-right"><label for="last_name">Last Name</label>
              <input type="text" name="last_name" id="last_name" value='<?php echo $employee['last_name'] ?>'/></td>
            <td><label for="locality_id">Locality ID</label>
              <input type="text" name="locality_id" id="locality_id" value='<?php echo $employee['locality_id'] ?>'/></td>
          </tr>
          <tr>
            <td class="align-right"><label for="suffix">Suffix</label>
              <input type="text" name="suffix" id="suffix" value='<?php echo $employee['suffix'] ?>'/></td>
            <td><label for="home_phone">Phone(Home)</label>
              <input type="text" name="home_phone" id="home_phone" value='<?php echo $employee['home_phone'] ?>'/></td>
          </tr>
          <tr>
            <td class="align-right"><label for="gender">Gender</label>
              <select>
                <option selected><?php echo  $employee['gender'] ?></option>
                <option value="male">Male</option>
                <option value="female">Female</option>
              </select></td>
            <td><label for="mobile_phone">Phone(Mobile)</label>
              <input type="text" name="mobile_phone" id="mobile_phone" value='<?php echo  $employee['mobile_phone'] ?>'/></td>
          </tr>
           <td class="align-right">
              <input type="submit" id="submit-btn" value="Create Employee" />
           </td>
           <td>&nbsp;</td>
        </table>
      </form>
    </div>
  </div>

My problem is this data, is not being captured when saving on the database. My function in the database is as follows.

function add_employee($user_id, $first_name, $middle_name, $last_name, 
                      $suffix, $gender, $date_birth, $cbemail, 
                      $locality_id, $home_phone, $mobile_phone) {
    $db   =  load_db();
    $sql = "INSERT into employees (
            user_id, first_name, middle_name, last_name, 
            suffix, gender, date_birth, cbemail,
            locality_id, home_phone, mobile_phone 
            ) VALUES (
            $user_id, $first_name, $middle_name, $last_name, 
            $suffix, $gender, $date_birth, $cbemail,
            $locality_id, $home_phone, $mobile_phone
            )";
    $result = $db->query($sql);
}

Yes i'm requiring a POST but i don't know how to capture the "value" in the value field of the input boxes.

The submit button will redirect in this line of code.

if(isset($_POST['save_user'])){
    add_employee($_POST['user_id'], $_POST['first_name'], $_POST['middle_name'], $_POST['last_name'], 
                 $_POST['suffix'], $_POST['gender'], $_POST['date_birth'], $_POST['cbemail'], 
                 $_POST['locality_id'], $_POST['home_phone'], $_POST['mobile_phone']);

So any ideas? I hope you understand the problem.

Sometimes I wish there was a close reason that was "please parameterise". Would cut down on PHP/MySQL questions by 95% :) — Joachim Isaksson, May 16 '13 at 10:00

score 4 · Accepted Answer · answered May 16 '13 at 09:53

4

For strings to be stored in Mysql database you need to use '' (quotes).

So for string like $_POST['first_name'] , use '$_POST['first_name']'

Btw try to use parameterized queries to be safe too,

Then you should be good.

answered May 16 '13 at 09:53

Pruthvi Raj Nadimpalli

1,335
1
15
30

score 1 · Answer 2 · edited May 23 '17 at 12:04

1

String values in SQL must be quoted. You are dumping the data in without quoting it. This is invalid SQL.

Use paramaterized queries, these will automatically quote your data and also escape it to remove your enormous SQL injection security vulnerability.

edited May 23 '17 at 12:04

Community

1
1

answered May 16 '13 at 09:50

Quentin

914,110
126
1,211
1,335

score 0 · Answer 3 · answered May 16 '13 at 09:53

0

Use this.

function add_employee($user_id, $first_name, $middle_name, $last_name, 
                  $suffix, $gender, $date_birth, $cbemail, 
                  $locality_id, $home_phone, $mobile_phone) {
$db   =  load_db();
$sql = "INSERT into employees (
        user_id, first_name, middle_name, last_name, 
        suffix, gender, date_birth, cbemail,
        locality_id, home_phone, mobile_phone 
        ) VALUES (
        '".$user_id."', '".$first_name."', '".$middle_name."', '".$last_name."', 
        '".$suffix."', '".$gender."', '".$date_birth."', '".$cbemail."',
        '".$locality_id."', '".$home_phone."', '".$mobile_phone."'
        )";
$result = $db->query($sql);
}

answered May 16 '13 at 09:53

Bharat Chodvadiya

1,644
4
20
31

still doesn't work. Do i have to remove my comments at the top? but it gives me index error. – Ey Jay May 16 '13 at 10:06
@AjVillalobos Your user_id in table is auto increment? – Bharat Chodvadiya May 16 '13 at 10:19
no user id is a foreign key from another table. The user_id and email are from an email link, thats why i used a get statement. – Ey Jay May 16 '13 at 13:47

score 0 · Answer 4 · answered May 16 '13 at 10:07

0

What is if(isset($_POST['save_user'])){ I don't see any field with save_user name. You should change it to some thing else may be if(isset($_POST['user_id'])){ Also You would need quotes as mention by others.

answered May 16 '13 at 10:07

Dharmesh Patel

1,881
1
11
12

save_user is the name of the submit button which is being called as an if-else statement in the last code above, i am with 2 developers and they create there own framework that function like that. – Ey Jay May 16 '13 at 13:45

$_POST error saving mysql database

4 Answers4