Inputting variables from GET into a SQL Database not working

Question

I'm trying to insert variables from $_GET into a MySQL Database. I am a noob and I can't figure out what is wrong with it! The code runs and it outputs the user and userid added to table but when I check in phpMyAdmin

$username = "username";
$password = "password";
$host = "host";
$database = "database";
$input_username = $_GET["username"];
$input_userId = $_GET["userId"];
mysql_connect($host,$username,$password);
mysql_select_db($database) or die("Couldn't select database: " . $database);
$sql = "INSERT INTO  users( UserId ,  Username )        VALUES('$_GET['userId']','$_GET['username']');";
echo "Username: " . $input_username . ", UserId: " . $input_userId ." added to table.";
mysql_close();

EDIT: I altered the code to fit the replied answers but now I get this error:

Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in PAGEPATH on line 10

Good thing it's not working. You're vulnerable to [SQL injection attacks](http://bobby-tables.com). You also have absolutely **NO** error handling and are blindly assuming everything will work perfectly and NEVER fail. — Marc B, Dec 29 '13 at 20:04
@fred: I'd -infinite if I could. You just introduced syntax errors, — Marc B, Dec 29 '13 at 20:05
I did? @MarcB Lordie Lordie. Ok then. Scratch that (OP) I hate `mysql_*` lol — Funk Forty Niner, Dec 29 '13 at 20:06
To: (OP) Do read up on this => http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php as per Marc's comment on SQL injection. — Funk Forty Niner, Dec 29 '13 at 20:07
@fred. You can't quote array keys in a double-quoted string, unless you're using `{}` notation. `"$arr['bad'] {$arr['good']} $arr[good]"`. — Marc B, Dec 29 '13 at 20:07
Where is `mysql_query`. Nowhere do you actually execute the query. — Giacomo1968, Dec 29 '13 at 20:10
Loko at Tosx’s answer. Just add `mysql_query($sql, $db);` after the line that has the `$sql`. — Giacomo1968, Dec 29 '13 at 20:14

Tosx · Answer 1 · 2013-12-29T20:23:00.977

2

You didn't execute the query! Add :

    $db = mysql_connect($host,$username,$password);
    mysql_select_db($database) or die("Couldn't select database: " . $database);

 $userId = mysql_real_escape_string($_GET["userid"]);
 $userName = mysql_real_escape_string($_GET["username"]);

$sql = "INSERT INTO  users(  UserId ,  Username ) 
VALUES ('". $userId  ."','". $userName  ."');";

        mysql_query($sql, $db);

edited Dec 29 '13 at 20:23

answered Dec 29 '13 at 20:07

Tosx

606
3
8

The “vulnerability” is irrelevant to the original question. The question of SQL injection is a non-issue in this small script. Who cares? – Giacomo1968 Dec 29 '13 at 20:11
You're right JakeGould it's why i just answer the basic question :) – Tosx Dec 29 '13 at 20:13
1

downvote will be harsh but @PeteR right. if OP doesn't realise now, he never will. – itachi Dec 29 '13 at 20:13
“if OP doesn't realise now, he never will.” EXACTLY! Let the original poster learn. If they can’t even run the query they will never understand larger concepts. – Giacomo1968 Dec 29 '13 at 20:15
@JakeGould: Yes, you are quite right. Why should I, or anyone else, actually give a crap? It's not my site, downvote retracted. – The Blue Dog Dec 29 '13 at 20:15
This will be a bit more safe @Adam S – Tosx Dec 29 '13 at 20:23

score 1 · Answer 2 · edited Dec 29 '13 at 20:17

1

Try this i have remove ; and add mysql_query($sql);

<?php
$username = "sd";
$password = "asd";
$host = "sad";
$database = "asd";


$input_username = $_GET["username"];
$input_userId = $_GET["userId"];

mysql_connect($host,$username,$password);

mysql_select_db($database) or die("Couldn't select database: " . $database);

$sql = "INSERT INTO  users(  UserId ,  Username ) 
VALUES ('$_GET[userid]','$_GET[username]')";
mysql_query($sql);

echo "Username: " . $input_username . ", UserId: " . $input_userId ." added to table.";
mysql_close();
?>

edited Dec 29 '13 at 20:17

Adam S.

305
1
3
14

answered Dec 29 '13 at 20:06

Muhammad Rashid

563
1
6
25

1

erm... have you **really** just put your username and password there? – ChrisW Dec 29 '13 at 20:07
No - the answer has no edits. They were there from the original post. – ChrisW Dec 29 '13 at 20:14
i have just copy and paste and add changes – Muhammad Rashid Dec 29 '13 at 20:15
Removed them and data base. I can't believe I forgot to remove them in the first place. – Adam S. Dec 29 '13 at 20:21
Yes,some time we forgot normal things – Muhammad Rashid Dec 29 '13 at 20:23

score 1 · Answer 3 · answered Dec 29 '13 at 20:13

1

Well, If you want to use a so vulnerable code, your sql must looks like:

$sql = "INSERT INTO  users(  UserId ,  Username ) 
VALUES ('".$_GET["userid"]."','".$_GET["username"]."');";
mysql_query($sql, $db);

answered Dec 29 '13 at 20:13

MillaresRoo

3,808
1
31
37

**execute the query** – itachi Dec 29 '13 at 20:15

Inputting variables from GET into a SQL Database not working

3 Answers3