Form data wont insert into SQL db

Question

I am trying to make a simple appeal form that the data gets posted to a SQL database. But when i submit, either nothing happens, or blank data gets submitted.

Heres my form:

<form class="form-horizontal" role="form" action="insert.php" method="post">
  <div class="form-group">

    <label for="user" class="col-sm-2 control-label">
      Username:
    </label>
    <div class="col-sm-10">
      <input type="text" class="form-control" name="user" id="user" placeholder="DiscordTag#0000" />
    </div>
  </div>
  <div class="form-group">

    <label for="date" class="col-sm-2 control-label">
      Date of ban:
    </label>
    <div class="col-sm-10">
      <input type="date" class="form-control" name="date" id="date" placeholder="mm/dd/yy" />
    </div>
  </div>
  <div class="form-group">

    <label for="admin" class="col-sm-2 control-label">
      Who banned you?
    </label>
    <div class="col-sm-10">
      <input type="text" class="form-control" name="admin" id="admin" />
    </div>
  </div>
  <div class="form-group">

    <label for="appeal" class="col-sm-2 control-label">
      Appeal:
    </label>
    <div class="col-sm-10">
      <textarea class="form-control" rows="4" name="appeal" id="appeal"></textarea>
    </div>
  </div>
  <div class="form-group">
    <div class="col-sm-offset-2 col-sm-10">

      <button type="submit" class="btn btn-default">
        Submit
      </button>
    </div>
  </div>
</form>

And here is my insert.php

<html>
<?
    error_reporting(E_ALL); 

    $db_host = 'redacted';
    $db_username = 'redacted';
    $db_password = 'redacted';
    $db_name = 'redacted';

    if( $_POST )
    {
        $conn = mysql_connect( $db_host, $db_username, $db_password);

        if (!$conn)
        {
            die('Could not connect: ' . mysql_error());
        } else {
            mysql_select_db("redacted");
        }

        $user = $_POST['user'];
        $date = $_POST['date'];
        $admin = $_POST['admin'];
        $appeal = $_POST['appeal'];

        $sql = 'INSERT INTO appeals' . '(user, date, admin, appeal)'
                .'VALUES ($user, $date, $admin, $appeal)';

        $retval = mysql_query( $sql, $conn );

        if(! $retval ) {
            die('Could not enter data: ' . mysql_error());
        }

        echo "<h2>Your appeal has been submitted.</h2>";

        mysql_close($conn);
    }
?>
</html>

How can i make it submit all of the form data directly into my SQL table?

Every time you use [the `mysql_`](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php) database extension in _meow_ code **[a Kitten is strangled somewhere in the world](http://2.bp.blogspot.com/-zCT6jizimfI/UjJ5UTb_BeI/AAAAAAAACgg/AS6XCd6aNdg/s1600/luna_getting_strangled.jpg)** it is deprecated and has been for years and is gone for ever in PHP7. If you are just learning PHP, spend your energies learning the `PDO` or `mysqli` database extensions. [Start here](http://php.net/manual/en/book.pdo.php) — RiggsFolly, Sep 05 '16 at 19:41
what did `mysql_error()` throw back, or did it ever make it there in the first place? — Funk Forty Niner, Sep 05 '16 at 19:41
You haven't quoted your values. I'm surprised if you're not getting SQL errors. You also have zero real error handling and take no account of security issues (i.e. SQL injection in this case). — Jonnix, Sep 05 '16 at 19:42
Throw it away, read the PDO manual, Start again http://php.net/manual/en/book.pdo.php — RiggsFolly, Sep 05 '16 at 19:44
You can't have variables in single quotes, if you want them to be variables. `Unlike the double-quoted and heredoc syntaxes, variables and escape sequences for special characters will not be expanded when they occur in single quoted strings.`-http://php.net/manual/en/language.types.string.php — chris85, Sep 05 '16 at 19:44

iliaz · Answer 1 · 2016-09-05T20:41:32.090

0

Use "INSERT INTO appeals (user, date, admin, appeal) VALUES ('".$user."', '".$date."', '".$admin."', '".$appeal."')";

And sanitize, because you are asking for an sql injection.

edited Sep 05 '16 at 20:41

answered Sep 05 '16 at 19:50

iliaz

395
2
10

`"VALUES ($user, $date, $admin, $appeal)";` You realize what you posted will not work. – Funk Forty Niner Sep 05 '16 at 20:04
I was trying to make a point, edited it to be c/p ready. – iliaz Sep 05 '16 at 20:40
Your edit will still fail `('user', 'date', 'admin', 'appeal')`. Read up on identifier qualifiers http://dev.mysql.com/doc/refman/5.7/en/identifier-qualifiers.html – Funk Forty Niner Sep 05 '16 at 20:41

Form data wont insert into SQL db

1 Answers1