php inserting into a MySQL data field

Question

I am not sure what I am doing wrong, can anybody tell me?

I have one variable - $tally5 - that I want to insert into database jdixon_WC14 table called PREDICTIONS - the field is called TOTAL_POINTS (int 11 with 0 as the default)

Here is the code I am using. I have made sure that the variable $tally5 is being calculated correctly, but the database won't update. I got the following from an online tutorial after trying one that used mysqli, but that left me a scary error I didn't understand at all :)

if(! get_magic_quotes_gpc() )
{
$points = addslashes ($tally5);
}
else
{
$points = $tally5;
}

$sql = "INSERT INTO PREDICTIONS ".
   "(TOTAL_POINTS) ".
   "VALUES('$points', NOW())";
mysql_select_db('jdixon_WC14');

I amended it to suit my variable name, but I am sure I have really botched this up!

help! :)

*"I got the following from an online tutorial after trying one that used `mysqli`"* --- and you're using `mysql_*` functions? Do show full code. Plus, you're selecting your DB **after** you're querying. — Funk Forty Niner, May 28 '14 at 19:50
What version of PHP do you use? The magic quotes are removed as of PHP 5.4.0 and were deprecated long ago. And no: it's not a good idea to use addslashes(). Better use prepared statements with placeholders, i.e. with PDO (or mysqli). — VMai, May 28 '14 at 19:56
lot of this is missing in your code, first your query is wrong, and your not using mysql_connect and mysql_query function — Nanhe Kumar, May 28 '14 at 19:59
The real answer => [**Use prepared statements and nothing but.**](http://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php) — Funk Forty Niner, May 28 '14 at 20:02

score 0 · Answer 1 · answered May 28 '14 at 19:59

0

I think you just need to learn more about PHP and its relation with MYSQL. I will share a simple example of insertion into a mysql database.

<?php
$con=mysqli_connect("localhost","peter","abc123","my_db");

// Check for errors in connection to database. 
if (mysqli_connect_errno()) {
    echo "Failed to connect to MySQL: " . mysqli_connect_error();
}

$query = "INSERT INTO Persons (FirstName, LastName, Age) VALUES ('Peter', 'Griffin',35)";

mysqli_query($con, $query);

mysqli_close($con); //Close connection
?>

First, you need to connect to the database with the mysqli_connect function. Then you can do the query and close the connection

answered May 28 '14 at 19:59

David Corbin

524
2
11
25

2

Although noble, you should note that this is open to [**SQL injection**](http://stackoverflow.com/q/60174/), it's best to [**use prepared statements and nothing but.**](http://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php) – Funk Forty Niner May 28 '14 at 20:05
@Fred-ii- You're correct. I could do mysqli_real_escape_string() but I just wanted to show an example to help showing OP what works. – David Corbin May 28 '14 at 20:08
True, yet prepared statements do add that extra little "boost" ;-) – Funk Forty Niner May 28 '14 at 20:09
The plot thickens - *"I never intended to "INSERT" anything, I intended to "UPDATE" an existing field."* - [**Source**](http://stackoverflow.com/a/23921049/) – Funk Forty Niner May 28 '14 at 20:28
All the same, just change your `$query` to something like `"UPDATE Persons SET Age=36 WHERE FirstName='Peter' AND LastName='Griffin'"`. I only used insert because OP's code has an insert statement. – David Corbin May 28 '14 at 20:33
Yeah I know. The OP's question was vague from the "get go". – Funk Forty Niner May 28 '14 at 20:34
*"I only used insert because `your` code has an insert statement."* --- That should be aimed at the OP, not moi ;-) – Funk Forty Niner May 28 '14 at 20:35
1

Changed it from 'your'! – David Corbin May 28 '14 at 20:37

score 0 · Answer 2 · answered May 28 '14 at 20:02

Briefly,

For every PHP function you use, look it up here first. (You will learn that it is better to go with mysqli).

http://www.php.net/manual/en/ <---use the search feature

Try working on the SQL statement first. If you have the INSERT process down, proceed.
You need to use mysql_connect() before using mysql_select_db()
Once you have a connection and have selected a database, now you my run a query with mysql_query()

When you get more advanced, you'll learn how to integrate error checking and response into the connection, database selection, and query routines. Convert to mysqli or other solutions that are not going to be deprecated soon (it is all in the PHP manual). Good luck!

score -1 · Answer 3 · answered May 28 '14 at 19:59

-1

if(! get_magic_quotes_gpc() )
{
$points = addslashes ($tally5);
}
else
{
$points = $tally5;
}
mysql_select_db('jdixon_WC14');
$sql = "INSERT INTO PREDICTIONS (TOTAL_POINTS,DATE) ". //write your date field name instead "DATE"
"VALUES('$points', NOW())";
mysql_query($sql);

answered May 28 '14 at 19:59

Dmitry Borovkov

289
4
16

-1, magic quotes are *gone*, and **never** use `addslashes` for **anything**. – Charles May 29 '14 at 02:43
@Charles, I just show how to make author`s code works – Dmitry Borovkov May 29 '14 at 17:40

php inserting into a MySQL data field

3 Answers3