4

The problem: insert.php connects fine, but only inserts empty values ('') when I hit 'save' on the html form. The text I type, which I'm trying to insert, isn't saved. Somewhere a connection isn't being made and that data is lost but I can't figure out exactly where. Any help?

HTML insert form (collecting data for 2 parameters, 'user' and 'thread')

<form action="insert.php" method="post">
user: <input type="text" name="user"><br>
thread: <input type="text" name="thread"><br>
<input type="submit" value="Save">
</form>

PHP code to connect to SQL, insert inputted values

<?php

$user = $_POST['user'];
$thread = $_POST['thread'];

$servername = "##.##.###";
$username = "harwoodjp";
$password = "~";
$dbname = "332";

//create connection
$conn = new mysqli($servername, $username, $password, $dbname);

//check connection
if ($conn->connect_error) {
    die("SQL (&#9746)<br/> " . $conn->connect_error);
}
echo "SQL (&#9745) <br/>";

$sql = mysql_connect($servername,$username,$password);
mysql_connect($servername,$username,$password);
mysql_select_db("332project");

//insert values
$insert_query = "INSERT INTO test1(user,thread) VALUES ('$user', '$thread')";
mysql_query($insert_query);

echo "<script>window.location='select.php'</script>"; //select.php displays the full table

//close MySQL
mysql_close($sql);
?>
Justin Harwood
  • 47
  • 6
  • 1
    Some generic remarks: it seems you connect three times (1x `new mysqli`, 2x `mysql_connect`). You also do not escape the form input. What would the insert query look like when I write the following in the user field: `', ''); DROP DATABASE DATABASE(); --` (hint: it will delete your entire database). Sanitize your inputs! :-) – Tomas Creemers Nov 30 '14 at 00:08
  • Another remark: use [header('Location: select.php'); die();](http://php.net/manual/en/function.header.php) if you're just trying redirect. Use them as your last lines of code. – Lynn Adrianna Nov 30 '14 at 02:04

2 Answers2

1

try this

<?php

$user = $_POST['user'];
$thread = $_POST['thread'];

$servername = "localhost";
$username = "root";
$password = "";
$dbname = "db";

//create connection
$conn = mysql($servername, $username, $password, $dbname);

//check connection
if ($conn->connect_error) {
    die("SQL (&#9746)<br/> " . $conn->connect_error);
}
echo "SQL (&#9745) <br/>";

$sql = mysql_connect($servername,$username,$password);
mysql_select_db("db");

//insert values
$insert_query = "INSERT INTO test1(user,thread) VALUES ('$user', '$thread')";
mysql_query($insert_query);

echo "<script>window.location='select.php'</script>"; //select.php displays the full table

//close MySQL
mysql_close($sql);

?>
jay.jivani
  • 1,560
  • 1
  • 16
  • 33
  • Thanks for cleaning it up. Unfortunately, the problem persists, even with this code. $insert_query echoes 'INSERT INTO test1(user,thread) VALUES ('', '')', which means user and thread are still registering as empty values. – Justin Harwood Nov 30 '14 at 04:07
  • Hey, so now it's working for me. Mind if I ask what exactly you changed? Looks quite similar... – Justin Harwood Nov 30 '14 at 04:26
  • 1
    ya..sure..you write `mysql_connect($servername,$username,$password)` this line 2 times so mysql confuse to create connection & u use somewhere `mysql_*` and somewhere `mysqli_*`..so meaning is use any one of `mysql_*` or `mysqli_*` – jay.jivani Nov 30 '14 at 04:34
0

It might be because the default form posting method is GET.

Either change your $_POST to $_GET or add method="POST" to your form tag.

Community
  • 1
  • 1
Lynn Adrianna
  • 107
  • 7