0

I have a form, written in html + php.

  • I want to post the form to the database, everytime i post it i'll echo the first and last values from to form.

  • To test if they are corrert, after the value insert there is a check, everytime i get firstvalueLastvalueERROR

I DONT KNOW WHERE THE ERROR IS COMING FROM?

CODE:

<?php //data.php
require_once 'login.php'; 


// Get values from form
$naam              = $_POST['naam'];
$aanhef            = $_POST['aanhef'];
$naam_partner      = $_POST['naam_partner'];
$straatnaam        = $_POST['straatnaam'];  
$huisnummer        = $_POST['huisnummer'];  
$huis_letter       = $_POST['huis_letter'];
$postcode          = $_POST['postcode']; 
$plaats            = $_POST['plaats'];
$telefoon_nr       = $_POST['telefoon_nr'];
$email             = $_POST['email'];   
$trap              = $_POST['trap'];
$lunch             = $_POST['lunch'];
$route             = $_POST['route'];   
$opmerkingen       = $_POST['opmerkingen'];
$kenmerk           = date('Y-m-d H:i:s');


//test if input is correctly handled   
echo $naam;
echo $opmerkingen;
echo $kenmerk;

// Insert data into mysql
$sql="INSERT INTO sbpvught.inschrijvingen (naam, aanhef, naam_partner, straatnaam, huisnummer,            
huis_letter, postcode, plaats, telefoon_nr, email, trap, lunch, route, opmerkingen, kenmerk)

                VALUES('$naam', '$aanhef', '$naam_partner',     
'$straatnaam','$huisnummer', '$huis_letter', '$postcode', '$plaats','$telefoon_nr', '$email',    
'$trap', '$lunch', '$route', '$opmerkingen', '$kenmerk')";

$result = mysql_query($sql); 


// if successfully insert data into database, displays message "Successful".
if($result){
header('Location: thankyou.php');
}
else {
echo "ERROR";
}

// close mysql
mysql_close();
?> 

<?php
$autoreply="Uw inschrijving is ontvangen, hartelijk dank. De betaling wordt zo spoedig mogelijk       
verwerkt zodra u betaald heeft. Dit is uw betalingskenmerk : $kenmerk";

$subject="Bedankt voor uw inschrijving $naam!";
$default="webmaster@sbpvught.nl";

mail($email, $subject, $autoreply);

?>
Olivier
  • 63
  • 3
  • 8
  • 2
    Your code is vulnerable to SQL injections. You should read on [how to prevent them in PHP](http://stackoverflow.com/q/60174/53114). This may also solve your problem. – Gumbo Apr 16 '14 at 11:56
  • 1
    do an `echo $sql;` before the mysql_query, see and debug your query. copy query here if you need further help. as noted by Gumbo, you are vulnerable in sql injection and a single `'` can mess up your query. – Sharky Apr 16 '14 at 11:59
  • If u meant to say that you are getting an error in echo of the date, Try giving it a default time zone first date_default_timezone_set('Asia/Calcutta'); – sss999 Apr 16 '14 at 12:07
  • try: http://www.php.net/manual/de/function.mysql-error.php – Jacob A. Apr 16 '14 at 12:09
  • also make sure you are entering the date in the exact format:- 2014-04-15 15:09:03 – sss999 Apr 16 '14 at 12:10
  • the query output is correct, and is corresponding with the database.. and thank you for notify me that i'm vulnerable to injection! – Olivier Apr 16 '14 at 12:18
  • I wonder what happens if I pass in `opmerkingen` field this value: `abc','2014-01-01 00:00:00'); drop table sbpvught.inschrijvingen; --` (see here - http://xkcd.com/327/) – Aleks G Apr 16 '14 at 12:59
  • what is your error ? can you paste your form code here.? – shashank Apr 16 '14 at 13:14
  • Thanks for all the replies, i made a bad mistake..... had the wrong login-req.php that's why i got the error, i used mysql_error() and the user was not allowed to.. haha.. now i'm going to use PDO e.t.c., thanks – Olivier Apr 18 '14 at 20:52

0 Answers0