HTML Form won't submit to database

Question

I want the data inputed into the form by the user to be submitted to a database. But for some reason my code isn't working?

 <form action="newpostsubmit.php" method="post">
    <h2 class="form-signin-heading">New Post (beta)</h2>
     <div class="form-group">
     <label for="title">Title</label>
      <input type="text" class="form-control" name="title" id="title">
    </div>

    <br>

    <div class="form-group">
        <label for="post">Post</label>
         <textarea class="form-control" rows="5" name="post" id="post"></textarea>
    </div>

    <br>

<input type="submit">

  </form>

PHP submit

<?php
//Connecting to sql db.
$connect = mysqli_connect("localhost","root","pwd","db");

//Sending form data to sql db.
mysqli_query($connect,"INSERT INTO posts (title, post)
VALUES ('$_POST[title]', '$_POST[post]')";
?>

The name in your HTML inputs must match the names in POST,for example $_POST[title] — Mihai, Jul 10 '15 at 12:23
IS your file named newpostsubmit.php?Is it in the same folder with the html file? — Mihai, Jul 10 '15 at 12:29
Try just `echo` ing the value of `$_POST['title']` and `$_POST['post']` in your php file. And check if the name of the PHP file you are submitting to is __newpostsubmit.php__ — Abey, Jul 10 '15 at 12:34
Try to `var_dump()` the last SQL error using `mysqli_error($connection)`. This can help provide information about any non-obvious errors. — AnotherGuy, Jul 10 '15 at 12:37
[Your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — Jay Blanchard, Jul 10 '15 at 12:52

score 2 · Answer 1 · edited May 23 '17 at 11:51

First, your $_POST variables are incorrect as you're forgetting to quote the item like $_POST['title'].

Second, you really should use prepared statements. They'll make your code cleaner and have the added benefit of protecting you against SQL Injection Attacks..

You should also perform minimal error checking of your connection and your queries, it is likely that you're missing some information that will help you to be successful. The errors are already in your error log, but you can make them echo out to the screen.

//Connecting to sql db.
$connect = mysqli_connect("localhost","root","pwd","db");
if (!$connect) {
    echo "Connection failed: ". mysqli_connect_error();
    exit();
}

//Sending form data to sql db.
$stmt = mysqli_prepare($connect, "INSERT INTO `posts` (`title`, `post`) VALUES (?,?)");
mysqli_stmt_bind_param($stmt, 'ss', $_POST['title'], $_POST['post'] );

// execute prepared statement
mysqli_stmt_execute($stmt);

// was there a problem?
if(mysqli_stmt_error($stmt)) {
    echo "There was an error performing the query, " . mysqli_stmt_error($stmt);
}

There is a a lot going on here, but most notable is the prepare() where you use placeholders for your variables (?) and mysqli_stmt_bind_param() to bind your variables, as strings (s for each item) to the query.

Finally, check if there are any errors and echo those back to the screen with mysqli_stmt_error()

NOTE: Make sure to handle errors gracefully for your users, never displaying the actual problems to them which exposes your site to attacks. Echoing the information to the screen, as is being done here, is fine during the development stage.

MaggsWeb · Answer 2 · 2015-07-10T12:34:18.707

0

You need to clean your POSTed variables to prevent SQL injections and other errors, and then quote them properly (as strings) on inserting them into the db.

$cleanTitle = mysqli_real_escape_string($connect,$_POST['title'];
$cleanPost  = mysqli_real_escape_string($connect,$_POST['post'];

$sql = "INSERT INTO posts (title, post) VALUES ('$cleanTitle', '$cleanPost')";
$insert = mysqli_query($connect,$sql);

if(!$insert){
    echo 'ERROR :'.mysqli_error($connect);
}

edited Jul 10 '15 at 12:34

answered Jul 10 '15 at 12:29

MaggsWeb

3,018
1
13
23

Add the check for successfull insert above. If the error is DB related - it should show you. – MaggsWeb Jul 10 '15 at 12:35
Noting shows up when i submit, so must be a PHP problem? I have syntax error on the 'clean title' and 'clean post' lines – mattmill98 Jul 10 '15 at 12:39
Then start with: var_dump($_POST). :) – MaggsWeb Jul 10 '15 at 12:39

score 0 · Answer 3 · answered Jul 10 '15 at 12:39

0

   mysqli_query($connect,"INSERT INTO posts (title, post)
   VALUES ('".$_POST[title]."', '".$_POST[post]."')";

query should be like this. Hope this helps.

answered Jul 10 '15 at 12:39

Harish Lalwani

754
5
20

have you not heard of an SQL Injection..? – MaggsWeb Jul 10 '15 at 12:40
1

yes I have. use mysql_real_escape_string(), strip_tags to prevent. But answer to the specified problem is this. – Harish Lalwani Jul 10 '15 at 12:50
mysqli_* would be better.. mysql_* has been deprecated. – MaggsWeb Jul 10 '15 at 12:52

HTML Form won't submit to database

3 Answers3