The form values entered are not getting stored in MYSQL database

Question

I'm a newbie in HTML and PHP, so please do help. The values entered in the form are not getting stored in the database. I've checked for the database connection and it is connecting. I have no idea what's wrong with the code.

<?php 
include("con.php");
$msg="";
if(isset($_POST["sub_btn"]))   {
  $id_length=6;
  $id=crypt(uniqid(rand(),1));
  $id=strip_tags(stripslashes($id));
  $id=str_replace(".","",$id);
  $id=strrev(str_replace("/","",$id));
  $id=substr($id,0,$id_length);
  $userid=$id;
  $fname=$_POST["fname"];
  $lname=$_POST["lname"];   
  $street=$_POST["street"];
  $city=$_POST["city"];
  $pin=$_POST["pin"];
  $mail=$_POST["mail"];
  $phone=$_POST["phone"];
  $password=$_POST["pwd"];
  $passconf=$_POST["pwdc"];


  $mail_check="SELECT mail FROM userdata WHERE mail='$mail'";

  $res=mysqli_query($db,$mail_check);
  $row=mysqli_fetch_array($res,MYSQLI_ASSOC);
  if(mysqli_num_rows($res)==1)  {
      $msg= "This email is already registered. Please login or use another email ID.";
  }

  else if (empty($fname) ||empty($lname) ||empty($street) ||empty($city) ||empty($pin) ||empty($mail) ||empty($phone) ||empty($password) ||empty($passconf))    {
      //Checks for any blank field.
      $msg="Cannot leave the field blank!";
  }
  elseif($password!=$passconf)  {
      //Checks for matching password.
      $msg= "Passwords don't match!";
  }
  else  {
      $query=mysqli_query($db,"INSERT INTO userdata(userid, fname, lname, street, city, pin, mail, phone, password) VALUES('$userid','$fname','$lname','$street','$city','$pin','$mail','$phone','$password')");

      if($query)  {
          $msg= "Thank you! You are now registered.";
          //Or give another link to redirect.
      }
  }
}
?>


<!DOCTYPE HTML>
<html>
<head>
  <title>Signup</title>
  <link rel="stylesheet" type="text/css" href="signupcss.css">
  <link rel="icon" href="pageicon.png">
</head>
<body style="background:#212934;">

<div class="search_box" style="background:#85A25B;">

<form name="signup" action="index.php" method="post">

    <h1 style="text-align:center;">SIGNUP</h1>
    <h6 style="margin-left:36px;" >The <span style="color:#D62F0B">*</span> indicates required field.</h6>
    <hr class="fieldlen_long" style="text-align:center;">
    <ul class="form_style">

            <br><list><label>FULL NAME<span class="required"> *</span></label>
            <input type="text" name="fname"  class="fieldlen_split" placeholder="First Name" />
            <input type="text" name="lname" class="fieldlen_split" placeholder="Last Name" /></list><br>

            <list><label>ADDRESS</label></list>
            <list><input type="text" name="street" class="fieldlen_long" placeholder="Street" /></list>
            <list><input type="text" name="city" class="fieldlen_split" placeholder="City" />
            <input type="text" name="pin" maxlength="6" placeholder="Pincode" /></list>

    <br> 

            <list><label>EMAIL ID <span class="required"> *</span></label>
            <input type="email" name="mail" class="fieldlen_mail" placeholder="Email ID" /></list>


    <br>

            <list><label>PHONE<span class="required"> *</span></label><input type="text" name="phone" maxlength="10" placeholder="Phone" /></list>

    <br> 

            <list><label>PASSWORD<span class="required"> *</span></label><input type="password" name="pwd" class="field-divided" placeholder="Password"/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<input type="password" name="pwdc" class="field-divided" placeholder="Confirm Password"/></list> 

    <br>

            <div class="submitbutton">
            <list><input type="submit" name="sub_btn" value="SUBMIT" /></list></div>
    </ul>

</form>
</div>

[Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)*** Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! [Don't believe it?](http://stackoverflow.com/q/38297105/1011527) — Jay Blanchard, Oct 27 '16 at 15:37
**Never store plain text passwords!** Please use PHP's [built-in functions](http://jayblanchard.net/proper_password_hashing_with_PHP.html) to handle password security. If you're using a PHP version less than 5.5 you can use the `password_hash()` [compatibility pack](https://github.com/ircmaxell/password_compat). Make sure you ***[don't escape passwords](http://stackoverflow.com/q/36628418/1011527)*** or use any other cleansing mechanism on them before hashing. Doing so *changes* the password and causes unnecessary additional coding. — Jay Blanchard, Oct 27 '16 at 15:37
You're wide open for SQL injection. Since you're using mysqli, take advantage of prepared statements and bind_param. — aynber, Oct 27 '16 at 15:37
Have you checked your error logs? You're making an assumption the query is working. Add error reporting to the top of your file(s) right after your opening ` — Jay Blanchard, Oct 27 '16 at 15:38
@JayBlanchard I didn't understand much about injection attacks. I reaad about them though. Also this is just for learning, so I'm just interested in making sure the data is stored in database. I'll read more about password_hash soon. I'll add error report and check. — nightfall, Oct 27 '16 at 15:43
I hate when people say *"I'm not that far along..."* or *"This site will not be public..."* or *"It's only for school, so security doesn't matter..."*. If teachers and professors are not talking about security from day one, they're doing it wrong. Challenge them. They're teaching sloppy and dangerous coding practices which students will have to unlearn later. I also hate it when folks say, *"I'll add security later..."* or *"Security isn't important now..."* or *"Ignore the security risk..."*. If you don't have time to do it right the first time, when will you find the time to add it later? — Jay Blanchard, Oct 27 '16 at 15:44

The form values entered are not getting stored in MYSQL database

0 Answers0