PHP always evaluating to false with Post parameters

Question

I have already looked around Stack Overflow and found very similar questions (such as this one): if (!empty ($_POST)) not working

The code below is always echoing "Post is empty" even when posted with the following URL: http://localhost/gui.php?sql=Select+*+from+Constituents%3B

        <form>
        SQL Query: <input type="text" name="sql"><br>
        <input type="submit" value="Query">
        </form>
        <?php 
        if(!empty($_POST["sql"])){
            $sql = $_POST["sql"];
            $result = $conn->query($sql);

            if ($result->num_rows > 0) {
            // output data of each row
                while($row = $result->fetch_assoc()) {
                    echo "Name: " . $row["firstName"]. " " . $row["lastName"]. "<br>","Address: ", $row["address"], ", ", $row["city"],", ",$row["state"],", ",$row["zip"],"<br>","Phone: ", $row["phone"], ", ",$row["email"],"<br><br>";
                }
            } else {
                echo "No results for query";
            }
        }
        else{
            echo "Post is empty";
        }

I've tried switch to using the isset function, running a count on the post, and other things, but I am always hitting the echo "Post is empty"; statement regardless of what happens. I'm sure this is a really simple issue.

That is **INCREDIBLY** and **INSANELY STUPIDLY** insecure code. `gui.php?sql=drop database critical_data_that_cannot_get_lost`. "oops" — Marc B, Apr 23 '15 at 18:47
I know this. I'm merely playing around with PHP and setting up a viewer for my database (which is just a test database I'm using). I wanted to make sure I could get it to work before I play around with writing defensive code to avoid SQL injections. — Clayton Turner, Apr 23 '15 at 18:49

score 2 · Accepted Answer · edited May 23 '17 at 12:16

2

The reason is that your <form> doesn't contain/specifiy a POST method.

Forms default to GET if the method is omitted.

Therefore you need to modify it to <form method="post"> instead.

Sidenote which needs mentioning:

Plus, in regards to SQL injection which you are open to, use mysqli with prepared statements, or PDO with prepared statements, they're much safer.

Never trust user-input.

edited May 23 '17 at 12:16

Community

1
1

answered Apr 23 '15 at 18:41

Funk Forty Niner

74,450
15
68
141

Awesome! This worked. I thought I read self-posting to the same page only required just saying
...
so I omitted that. Thanks! – Clayton Turner Apr 23 '15 at 18:42

score 2 · Answer 2 · answered Apr 23 '15 at 18:43

2

you forgot to write form method.. you should add method tag in your form and set it post

<form method="post">

answered Apr 23 '15 at 18:43

Bushra Shahid

781
7
20

PHP always evaluating to false with Post parameters

2 Answers2