Create account using PHP to MySQL

Question

Im not to great with PHP/MySQL so excuse my ignorance. I have a login form on my website, i have created a form for creating an account, visually everything is fine, however, i need the data to be sent to my customer account table in mysql. When i submit the form, it seems to work, creating the ID 1, but all other fields are blank.

PHP:

<?php

$hostname="localhost";
$username="createaccount";
$password="******";
$dbname="Island_Web_Design";
$usertable="customer_accounts";
$connection = mysql_connect($hostname, $username, $password);
mysql_select_db($dbname, $connection);

$sql="INSERT INTO customer_accounts (firstname, lastname, email, password)
VALUES
('$_POST[firstname]','$_POST[lastname]','$_POST[email]','$_POST[password]')";


if (!mysql_query($sql,$connection))
  {
  die('Error: ' . mysql_error());
  }
echo "1 record added";

mysql_close($con);

?>

HTML:

<form role="form" action="Create_Account.php">
                            <div class="row">
                                <div class="col-xs-6 col-sm-6 col-md-6">
                                    <div class="form-group">
                                        <input type="text" name="firstname" id="firstname" class="form-control input-sm floatlabel createinput" placeholder="First Name">
                                    </div>
                                </div>
                                <div class="col-xs-6 col-sm-6 col-md-6">
                                    <div class="form-group">
                                        <input type="text" name="lastname" id="last_name" class="form-control input-sm createinput" placeholder="Last Name">
                                    </div>
                                </div>
                            </div>
                            <div class="form-group">
                                <input type="email" name="email" id="email" class="form-control input-sm createinput" placeholder="Email Address">
                            </div>
                            <div class="row">
                                <div class="col-xs-6 col-sm-6 col-md-6">
                                    <div class="form-group">
                                        <input type="password" name="password" id="password" class="form-control input-sm createinput" placeholder="Password">
                                    </div>
                                </div>
                                <div class="col-xs-6 col-sm-6 col-md-6">
                                    <div class="form-group">
                                        <input type="password" name="password_confirmation" id="password_confirmation" class="form-control input-sm createinput" placeholder="Confirm Password">
                                    </div>
                                </div>
                            </div>
                            <input type="submit" name="submit" value="Create Account" class="btn btn-primary btn-block register">
                        </form>

Thank you in advance.

Answer 1

For starters you should stop using mysql_* functions for new code. It is removed from the language in the latest version (7). Instead upgrade to either mysqli or PDO:

Why shouldn't I use mysql_* functions in PHP?.

Secondly you should prevent the SQL injection holes you have in your code:

How can I prevent SQL-injection in PHP?

Thirdly you should hash your password to prevent them from leaking when you have for example a security hole in your application.

password_hash()

Finally to get to your question: if you don't tell your form to POST it will make a GET request instead. Change your form to <form role="form" action="Create_Account.php" method="post">.

You can and should debug your code yourself for issues like these. The simplest form would be to use var_dump(); on your variables to see whether the contain what you think they contain. And you can also inspect the requests being made by opening the developer tools of your favorite browser.

Your code could / should be rewritten as:

<?php

$dbConnection = new PDO('mysql:dbname=Island_Web_Design;host=localhost;charset=utf8', 'createaccount', '******');

$dbConnection->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
$dbConnection->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

$stmt = $dbConnection->prepare('INSERT INTO customer_accounts (firstname, lastname, email, password) VALUES (:firstname, :lastname, :email, :password');

try {
    $stmt->execute([
        'firstname'=> $_POST[firstname],
        'lastname' => $_POST[lastname],
        'email' => $_POST[email],
        'password' => password_hash($_POST[password], PASSWORD_DEFAULT, ['cost' => 14]),
    ]);
} catch(\PDOException $e) {
    die('Error: ' . $e->getMessage());
}

echo "1 record added";

Answer 2

Please never do this:

('$_POST[firstname]','$_POST[lastname]','$_POST[email]','$_POST[password]')

read this: Is SQL Injection possible with POST?

Fix add method="post" inside form balise, thanks @jay