Can't insert using php/sql? Basic query

Question

I have a site where an admin can enter exam marks for papers which are part of an exam. I am on the final part of actually giving a user their mark. But I just can't seem to do it.

So far what I have done is: Allow the admin to view all of the exams, click on a specific exam and view the papers for that exam, then click on a paper and view all of the people who took that paper.

Then, click on a user and enter their marks and feedback. This is the part which I cannot do. I have pasted my code below along with what I am trying to do but it just is not working, any help would be great!

So, along with their mark and feedback I am also inserting into the marks table the, paperID and the examID.

CODE:

        <?php

        $epsID = $_GET['epsID'];
        $sql = "SELECT * FROM ExamPaperStudent WHERE epsID = '$epsID'";                     
        $result = mysql_query($sql);

        while ($row = mysql_fetch_array($result))
            {
                $epID = $row ['epID'];
                $sID = $row ['sID'];
                echo "<p><form>";
                echo "<b>Mark: <input type=text name=mark></b><br>";        
                echo "<b>Feedback: <input type=text name=feedback></b><br>";                                        

                echo $epID;                                                                             
                echo $sID;                                                  
                echo "</form>";     
                echo "<a href='insertmark.php?epsID=". $row['epsID']."'>Add Data</a>";                              
            }   
        ?>

INSERTMARK.php code: (At this form I already know the exam/paper ID, which I also am trying to insert (along with marks/feedback).

CODE:

        $mark = $_POST["mark"];
        $feedback = $_POST["feedback"];

        if(isset($_REQUEST['submit']))
            {
                $sql = mysql_query("insert INTO exammarks (mark, feedback, epID, atID) values ('$mark', '$feedback', '$epID', '$sID')");
                $result = mysql_query($result);
            }



epsID = exampaperstudent
epID = exampaper 
sID = student

You should read up on sql injection, switch to PDO or mysqli with prepared statements and add error handling. — jeroen, Feb 20 '14 at 21:07
your code is prone to sql injection. Use prepared statements. http://stackoverflow.com/a/60496/1463622 — Krimson, Feb 20 '14 at 21:14
mysql functions are now not suitable for newer web servers you should use mysqli functions instead — Dev Man, Feb 20 '14 at 21:17

echo_Me · Answer 1 · 2014-02-20T21:07:58.190

0

your form is wrong .

change this

  echo "<p><form>";

to

 echo "<p><form action='INSERTMARK.php' method='POST' name='myform'>";

OMG everything is wrong inside your inputs. i just give one and you correct the others

  echo "<b>Mark: <input type='text' name='mark'></b><br>"; 
                             ^----^------^----^---//use single quotes around here

didnt you miss submit button ?

edited Feb 20 '14 at 21:07

answered Feb 20 '14 at 21:02

echo_Me

37,078
5
58
78

dont use that link , it will be already submited to that page in the form action. – echo_Me Feb 20 '14 at 21:16

Can't insert using php/sql? Basic query

1 Answers1