-2

I have a form I made using HTML/PHP, And I would like it to submit to the database; I have a movies website and I am currently working on the admin panel, I want it to have a form that adds new movies to the site, I tried out my form, but nothing goes to the database. The connection with the database is fine and the queries look fine to me, I honestly do not know what the problem is.

P.S. I am making it in Arabic, the Arabic writing does not mean anything..

PHP/HTML code:

<?php
session_start();
include('php/config.php');

if($_SESSION['username'] != true){
header('Location: http://www.domain.com/'); 
}
//this form allows to choose what to do (e.g. add new movie)...
else{
echo'
<head>
<link rel="stylesheet" href="css/main.css" />
<link rel="stylesheet" href="css/admin.css" />
<meta charset="utf-8"/>
<title>Admin Panel v1.0</title>
</head>
<ul class="management-b">
<li><a href="#">إضافة فيلم جديد</a></li>
<li><a href="#">إضافة مسلسل جديد</a></li>
<li><a href="#">مسح فيلم/مسلسل</a></li>
</ul>
';
}


//this form adds new movies...
connectDB();
$genreQuery = mysql_query("SELECT genre FROM Genres");

echo'
<head>
<link rel="stylesheet" href="css/main.css"/>
<link rel="stylesheet" href="css/admin.css"/>
<meta charset="utf-8" />
</head>
<form method="post" id="new-movie">
عنوان الفيلم:<input type="text" class="new-movie-title" name="new-movie-title" /><br/><br/>
وصف الفيلم:<textarea class="new-movie-desc" name="new-movie-desc" cols="50" rows="7"></textarea><br/><br/>
نوع الفيلم:<select class="new-movie-genre" name="new-movie-genre">';
while($options = mysql_fetch_array($genreQuery, MYSQL_ASSOC)){
echo '<option>'.$options["genre"].'</option>';
}
echo'</select><br/><br/>
تاريخ الفيلم:<select class="new-movie-year" name="new-movie-year">';
for($years = 1995; $years<2017; $years++){
echo '<option>'.$years.'</option>'; 
}
echo'
</select><br/><br/>
رابط الفيلم:<input type="text" name="new-movie-link" class="new-movie-link"/><br/><br/>
صورة الفيلم:<input type="text" name="new-movie-img" class="new-movie-img" /><br/><br/>
تقييم imDB:<input type="text" name="new-movie-imdb" class="new-movie-imdb"/><br/><br/>
<input type="submit" name="new-movie-submit" class="new-movie-submit" value="إضافة الفيلم" />
</form>
';


if(isset($_POST['new-movie-submit'])){
    connectDB();
$mNewTitle= $_POST['new-movie-title'];
$mNewDesc= $_POST['new-movie-desc'];
$mNewGenre= $_POST['new-movie-genre'];
$mNewYear= $_POST['new-movie-year'];
$mNewURL= $_POST['new-movie-link'];
$mNewIMG= $_POST['new-movie-img'];
$mNewIMDB= $_POST['new-movie-imdb'];    

mysql_query("INSERT INTO Movies(title, description, genre, url, image, imdb, release-year) VALUES('$mNewTitle', '$mNewDesc', '$mNewGenre', '$mNewURL', '$mNewIMG', '$mNewIMDB', '$mNewYear'");
closeDB();
}


?>
Khalid Almalki
  • 65
  • 1
  • 7
  • You need to change to `mysqli_*` functions as `mysql_` is depreciated. You are also wide open to [SQL Injections](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php). – Tigger May 27 '16 at 23:51
  • @Tigger Yes, but does Mysql functions being depreciated affect submitting? – Khalid Almalki May 27 '16 at 23:54
  • Not now, but it may in the future. – Tigger May 27 '16 at 23:57
  • add `or die(mysql_error())` to `mysql_query()`. and make sure that `mysql_query()` isn't requiring db connection be made, otherwise you need to pass it as a parameter. We also don't know what `connectDB()` does and if it's even firing and if the connection is indeed `mysql_` and not `mysqli_` or PDO or other. – Funk Forty Niner May 28 '16 at 00:09
  • if your `connectDB();` function isn't return'ing anything, then you'd need to do `echo connectDB();`. – Funk Forty Niner May 28 '16 at 00:20
  • @Fred-ii- I have added "or die".. and the connectDB(); connects to the database and selects it, using only mysql functions, I have also got this new error: "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1" – Khalid Almalki May 28 '16 at 00:35
  • and there you have it; errors and it seems that you're probably getting empty values going in there and that I can't say for sure until we see what `var_dump()` reveals and/or the echo'd query. – Funk Forty Niner May 28 '16 at 00:39
  • and/or, there are characters being introduced that MySQL is complaining about being an apostrophe `'` (quote). If that is the case, then you need to escape (all) your POST arrays/values. I've my money on the quote(s) so use `mysql_real_escape_string()` for all your POST arrays. Using a prepared statement would fix all that. – Funk Forty Niner May 28 '16 at 00:42
  • ping me when what I said up there worked ^ – Funk Forty Niner May 28 '16 at 01:00
  • I'll try it in a couple of hours as I'm busy with something else right now; however thank you so much for being so helpful – Khalid Almalki May 28 '16 at 01:02

1 Answers1

1

If you checked for errors MySQL would tell you that you don't have a column identifier named year as release-year contains a dash in it which makes MySQL think you are subtracting the column identifier year from release. Wrap that column name in ticks to resolve this.

mysql_query("INSERT INTO Movies(title, description, genre, url, image, imdb, `release-year`) VALUES('$mNewTitle', '$mNewDesc', '$mNewGenre', '$mNewURL', '$mNewIMG', '$mNewIMDB', '$mNewYear'");

As mentioned in comments you are using an obsolete API as the mysql_* functions have all been removed from PHP in PHP 7 and you are wide open to SQL injections which is the most common form of web based attacks.

And as I mentioned before, you don't check for or handle errors. You would have caught this error quickly with basic error checking. You also need to be prepared for when errors happen or else your users will have a bad experience when an error occurs.

John Conde
  • 217,595
  • 99
  • 455
  • 496