-1

It doesn't insert row in the table.

/*add to group*/
if($edu_school=="I.T"){
    $group_id = $_POST["3"];
    $db->query(sprintf("INSERT INTO groups_members (group_id, user_id) VALUES (%s,%s)" )) or _error(SQL_ERROR_THROWEN); 
}
zloster
  • 1,149
  • 11
  • 26

2 Answers2

1

Where is you set value?!

Try like this

if($edu_school=="I.T"){
    $group_id = (string)$_POST["3"];
    $query=sprintf("INSERT INTO groups_members (group_id, user_id) VALUES (%s,%s)",$group_id,"1" );
     $db->query($query) or _error(SQL_ERROR_THROWEN);
}
ashkufaraz
  • 5,179
  • 6
  • 51
  • 82
1

The values for both string placeholders are missing. See sprintf for documentation.

Side note: Please be aware that with this method your code will still be vulnerable to SQL Injections.

Community
  • 1
  • 1
Tekay37
  • 467
  • 5
  • 18