php post method fails with no error

Question

I seem to be missing something in my code which restricts the post method and data not sent to my database. Database connection test is successful, but when i submit the form with entered data...am redirected to new_employee.php which means $_POST['submit'] is false but the form name='submit' is set.

Here's the php code

<?php  
if (isset($_POST['submit'])) {
    $first_name = $_POST["first_name"];
    $last_name = $_POST["last_name"];
    $dept_id = $_POST["dept_id"];
    $position = $_POST["position"];
    $hire_date = $_POST["hire_date"];
    $salary = $_POST["salary"];
    $bonus = $_POST["bonus"];
    $end_date = $_POST["end_date"];

    $sql  = "insert into staff (first_name, last_name, dept_id, position, hire_date, salary, bonus, end_date)";
    $sql .= " values ('{$first_name}', '{$last_name}', {$dept_id}, '{$position}', {$hire_date}, {$salary}, {$bonus}, {$end_date})";
    $result = mysqli_query($connection, $sql);

    if ($result) {
        redirect_to("employee.php");
    } else {
        redirect_to("new_employee.php");
    }
}?>

And here's the html form

<form action="new_employee.php" method="POST" role="form" class="form-horizontal">
                <legend>Add new employee</legend>

                <div class="col-md-10">
                    First Name: <input type="text" name="first_name" class="form-control" placeholder="First name">
                    Last Name: <input type="text" name="last_name" class="form-control" placeholder="Last name">
                    Department: <input type="text" name="dept_id" class="form-control" placeholder="Department">
                    Position: <input type="text" name="position" class="form-control" placeholder="Position">
                    Hire Date: <input type="text" name="hire_date" class="form-control" placeholder="Hire date">
                    Salary: <input type="text" name="salary" class="form-control" placeholder="Salary">
                    Bonus: <input type="text" name="bonus" class="form-control" placeholder="Bonus">
                    End Date: <input type="text" name="end_date" class="form-control" placeholder="Password">

                    <br/>
                    <div class="row text-right">
                        <input type="submit" name="submit" value="Save" class="btn btn-default" /> 
                        &nbsp 
                        <button type="button" class="btn btn-default" aria-label="Left Align"><a href="employee.php">Cancel</a></button>
                    </div>
                </div>
            </form>

Any help i can get here will be much appreciated.

According to your code, you are redirected to `new_employee.php` when your query failed, not when `$_POST['submit']` is not set. Try echoing your `$sql` and trying it directly in MySQL. My guess is that `$hire_date`, `$salary`, `$bonus` or `$end_date` are strings and need to be quoted. If any of them have any chars like `$`, `-`, `/`, etc. they are considered strings. Also, you may want to take a look at - [How can I prevent SQL-injection in php](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — Sean, Nov 21 '15 at 15:41
@GoatMaster the opening form tag is actually not messing, i have corrected the format. $hire_date, $salary, $bonus and $end_date are all nullable and are not string. For my test only first_name, last_name, dept_id and position are provide with other fields left blank Once i get my code right i will work on preventing sql injection — Mena, Nov 21 '15 at 16:15
@GoatMaster i tried my sql stmt directly on mysql like this -- insert into staff (first_name, last_name, dept_id, position, hire_date, salary, bonus, end_date) values ('pretty', 'emem', 101, 'teacher', null, null, null, null); -- the insert was successful — Mena, Nov 21 '15 at 16:31
An empty value for your `$_POST` vars does not translate to `null`. You need to echo out the actual `$sql` and you will see it looks like `... values ('pretty', 'emem', 101, 'teacher', , , , )` which is an invalid query. Try using conditionals like `$hire_date = (trim($_POST["hire_date"]) == "" ? 'null' : $_POST["hire_date"];` — Sean, Nov 21 '15 at 16:59
@Sean worked when i provided all data in the form. I decided to set default value for some fields and did not include them in the form. Appreciate all answers here...good work guys. — Mena, Nov 21 '15 at 21:09

score 0 · Answer 1 · answered Nov 21 '15 at 15:44

0

Your code is not right in my opinion. Try this sql variable instead of yours:

$sql  = "insert into staff (first_name, last_name, dept_id, position, hire_date, salary, bonus, end_date)";
$sql .= " values ('$first_name', '$last_name', $dept_id, '$position', $hire_date, $salary, $bonus, $end_date)";

answered Nov 21 '15 at 15:44

Mahyar Jafari

57
7

There is nothing wrong with the OP using curly brackets `{ }` in the double quoted query. It might be helpful for you to read up on the php manual about [Complex (curly) syntax - http://php.net/manual/en/language.types.string.php#language.types.string.parsing.complex](http://php.net/manual/en/language.types.string.php#language.types.string.parsing.complex) – Sean Nov 21 '15 at 15:51
@MahyarJafari i switched your code for mine and the result is still the same. Your suggestion is much appreciated – Mena Nov 21 '15 at 16:24

php post method fails with no error

1 Answers1