1

Can't figure out what I'm doing wrong here:

<?php
include "dbopen.php";
$fnamn = $_POST["fnamn"];
$enamn = $_POST["enamn"];
$email = $_POST["email"];

mysqli_query($dbconnect,"INSERT INTO personer (Fornamn, Efternamn, Email) VALUES ($fnamn, $enamn, $email)");

?>

The include tag works fine, since I can create data in phpmyadmin and get it to write out the data, but adding won't work. Ain't getting any errormessages either...

Thanks in advance!

Bitterfan
  • 11
  • 1
  • where is $dbconnect initialized? – Satya Nov 13 '13 at 03:32
  • What version of PHP are you using... AND WHY AREN'T YOU SANITIZING POST INPUT! Scary, scary, scary as that's the definition of a SQL Injection Attack's flawed code. –  Nov 13 '13 at 03:33
  • Your code is prone to SQL Injection try to use prepared statements or at least properly escape the user input. – bansi Nov 13 '13 at 03:34
  • Yeah, I know that. I'm always having trouble with dbs, my friend usually does that. So I wanted to get that to work first so I could get it out of my mind. – Bitterfan Nov 13 '13 at 03:36
  • You're using mysqli .. good. Now use *parameterized queries*. This will "fix" a problem (at least one of them) "magically". – user2864740 Nov 13 '13 at 03:37
  • Also, you're not getting any error messages because you're not checking the results! mysqli normally requires checking `->error` after a failing (returning FALSE) `->execute/query`. I suggest PDO and escalation to Exceptions. – user2864740 Nov 13 '13 at 03:54
  • the $dbconnect is within dbopen.php, the problem isn't there cause the exact same include works when I'm posting the data within the db. – Bitterfan Nov 13 '13 at 03:59

2 Answers2

0

Put quotes around these string values like

VALUES ('$fnamn', '$enamn', '$email')

And at the very minimum, run your POST values through mysqli_real_escape_string

Hanky Panky
  • 46,730
  • 8
  • 72
  • 95
  • No `mysqli_real_escape_string` please. The poster is using `mysqli` and thus has access to proper parameterized queries - in fact, using such would *eliminate the need for quotes entirely*. – user2864740 Nov 13 '13 at 03:36
  • ...how have I not tried that...feel so stupid atm...cheers though! :) – Bitterfan Nov 13 '13 at 03:39
  • @Bitterfan Please don't follow this advice. It encourages bad SQL practices. See http://stackoverflow.com/a/60496/2864740 for a very quick "intro". – user2864740 Nov 13 '13 at 03:40
  • Excuse me @user2864740. What benchmark do you have to decide what is right and wrong? Go tell PHP to remove all the non parameterized query functions from their code. Parameterized queries are no magic pills. I can still write code for you today using `mysql_*` which is as safe as your so called parameterized queries. – Hanky Panky Nov 13 '13 at 03:41
0
<?php
include "dbopen.php";

$fnamn = mysqli_real_escape_string($dbconnect, $_POST["fnamn"]);
$enamn = mysqli_real_escape_string($dbconnect, $_POST["enamn"]);
$email = mysqli_real_escape_string($dbconnect, $_POST["email"]);

$sql = "INSERT INTO `personer` (`Fornamn`, `Efternamn`, `Email`) VALUES ('".$fnamn."', '".$enamn."', '".$email."');";

if (mysqli_query($dbconnect, $sql) === true) {
    printf('Success');
} else {
    print_f(mysqli_error($dbconnect));
}

?>
Hanky Panky
  • 46,730
  • 8
  • 72
  • 95
Jacob Mulquin
  • 3,458
  • 1
  • 19
  • 22
  • The poster is using `mysqli`. Please stop encouraging the use of `mysql_real_escape_string` and manual SQL string building. – user2864740 Nov 13 '13 at 03:48
  • 1
    Mate stop preaching and actually submit a bit of example code to get the person going. – Jacob Mulquin Nov 13 '13 at 03:50
  • I have linked in the appropriate question once. [Here it is again](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php?lq=1). The accepted answer includes a nice small example using mysqli and enough keywords to find the applicable API. – user2864740 Nov 13 '13 at 03:51