1

I can not for the life of me figure out why the info i enter in from the form when it runs, will not enter into the database that i have linked to it. The info from the database shows up when I manually put it in, and the delete button works to erase the section of the database, but adding things doesnt work using the php form. Please help!

<?php
// A simple PHP script demonstrating how to connect to MySQL.
$servername = getenv('IP');
$username = getenv('C9_USER');
$password = "potato12";
$database = "c9";
$dbport = 3306;

// Create connection
$db = new mysqli($servername, $username, $password, $database, $dbport);

// Check connection
if ($db->connect_error) {
    die("Connection failed: " . $db->connect_error);
} 
echo "Connected successfully (".$db->host_info.")";

$thisPHP = $_SERVER['PHP_SELF'];

    echo <<<EOT
    <form action="$thisPHP" method="POST">
     Name: <input type="text" name="Name"> Address: <input type="text" name="Address"><br>
    Phone: <input type="text" name="Phone"> Email: <input type="text" name="Email"><br>
    Availability: <input type="Radio" name="Availability" Value="Now"> Now(<1 month) <input type="Radio" name="Availability" value="Soon"> Soon(1-3 months) <input type="Radio" name="Availability" value="Exploring"> Exploring(3+ months)<br>
    Company Title: <input type="text" name="Title"><br>
    Job Title: <input type="text" name="Job Title"><br>
    Description: <input type="text" name="Description"><br>


    Skill 1 <select name="Skill1">
    <option>Organized</option><option>Works in a team</option><option>Problem Solving</option>
    </select>


    Skill 2 <select name="Skill2">
    <option>Organized</option><option>Works in a team</option><option>Problem Solving</option></select>


    Skill 3 <select name="Skill3">
    <option>Organized</option><option>Works in a team</option><option>Problem Solving</option></select><br>


    Experiance <select name="Experiance">
    <option>0</option><option>1-3</option><option>3-5</option><option>5-10</option><option>10+</option></select><br>

    Position: <input type="radio" name="Position" value="Team-Member"> Team-Member <input type="radio" name="Position" value="Team-Leader"> Team-Leader <input type="radio" name="Position" value="Manager"> Manager <input type="radio" name="Position" value="Executive"> Executive <br>

    <input type="submit" name="Add" value="Add"> <br>
    <hr>
    </form>

EOT;

// Start executing the script

$id = $_POST["ID"];
$Name = $_POST["Name"];
$Email = $_POST["Email"];
$Phone = $_POST["Phone"];
$Address = $_POST["Address"];
$Availability = $_POST["Availability"];
$Ctitle = $_POST["Title"];
$Jtitle = $_POST["Job Title"];
$Description = $_POST["Description"];
$Skill1 = $_POST["Skill1"];
$Skill2 = $_POST["Skill2"];
$Skill3 = $_POST["Skill3"];
$Experiance = $_POST["Experiance"];
$Position = $_POST["Position"];




// At least name must be specified

if (!empty($name)){
    // Form sql string
    $sql = "insert into Employee (ID, Name, Phone, Email, Address, Availability, Title, Job Title, Description, Skill1, Skill2, Skill3, Experiance, Position ) values ('$id', '$Name', '$Phone', '$Email', '$Address' , '$Availability' , '$Ctitle' , '$Jtitle' , '$Description' , '$Skill1' , '$Skill2' , '$Skill3', '$Experiance' , '$Position')";
    if ($db->query ($sql) == TRUE)
    {
        echo "Record added <br>";
    }
}

// Check if delete is selected

if (isset($_POST['btnDelete'])) {
    $gid = $_POST['gid'];
    $sql = "delete from Employee where id='$id'";
    if ($db->query ($sql) == TRUE)
    {
        echo "Record deleted <br>";
    }
} 
else  if (isset($_POST['btnEdit'])) {
    $sql = "select * from Employee where id='$id'";
    if (($result = $db->query ($sql)) == TRUE)
    {
        while($row = $result->fetch_assoc()) {
    $id = $_POST["ID"];
    $Name = $_POST["Name"];
    $Email = $_POST["Email"];
    $Phone = $_POST["Phone"];
    $Address = $_POST["Address"];
    $Availability = $_POST["Availability"];
    $Ctitle = $_POST["title"];
    $Jtitle = $_POST["Job Title"];
    $Description = $_POST["Description"];
    $Skill1 = $_POST["Skill1"];
    $Skill2 = $_POST["Skill2"];
    $Skill3 = $_POST["Skill3"];
    $Experiance = $_POST["Experiance"];
        }

    }



    echo <<<EOE
    <form action="$thisPHP" method="POST">
             Name: <input type="text" name="name"> Address: <input type="text" name="Address"><br>
    Phone: <input type="text" name="phone"> Email: <input type="text" name="email"><br>
    Availability: <input type="Radio" name="Availability" Value="Now"> Now(<1 month) <input type="Radio" name="Availability" value="Soon"> Soon(1-3 months) <input type="Radio" name="Availability" value="Exploring"> Exploring(3+ months)<br>
    Company Title: <input type="text" name="title"><br>
    Job Title: <input type="text" name="Job Title"><br>
    Description: <input type="text" name="description"><br>


    Skill 1 <select name="skill1">
    <option>Organized</option><option>Works in a team</option><option>Problem Solving</option>
    </select>


    Skill 2 <select name="skill2">
    <option>Organized</option><option>Works in a team</option><option>Problem Solving</option></select>


    Skill 3 <select name="skill3">
    <option>Organized</option><option>Works in a team</option><option>Problem Solving</option></select><br>


    Experiance <select name="experiance">
    <option>0</option><option>1-3</option><option>3-5</option><option>5-10</option><option>10+</option></select><br>

    Position: <input type="radio" name=Position" value="Team-Member"> Team-Member <input type="radio" name=Position" value="Team-Leader"> Team-Leader <input type="radio" name=Position" value="Manager"> Manager <input type="radio" name=Position" value="Executive"> Executive <br>

    <input type="submit" name="Add" value="Add"> <br>
    <hr>
    </form>

EOE; }

// Show rows
$sql = "SELECT * FROM Employee";
$result = $db->query($sql);


if ($result->num_rows > 0) {
    // output data of each row
    while($row = $result->fetch_assoc()) 
    {
        $id = $row["ID"];
        echo 
        "id: " . $id . "  - Name: " . $row["Name"] .
        " - Email: " . $row["Email"] .
        " - Phone: " . $row["Phone"] .
        " - Address: " . $row["Address"] .
        " - Availability: " . $row["Availability"] .
        " - Company Title: " . $row["Company Title"] .
        " - Job Title: " . $row["Job Title"] .
        " - Description: " . $row["Description"] .
        " - Skill 1: " . $row["Skill1"] . 
        " - Skill 2: " . $row["Skill2"] . 
        " - Skill 3: " . $row["Skill3"] . 
        " - Experiance: " . $row["Experiance"]; 


        echo " <form action=\"$thisPHP\" method='post' style=\"display:inline\" >";
        echo "<input type='hidden' name='id' value='$id'>";
        echo "<input type='submit' name='btnEdit' value='Edit'> ";
        echo "<input type='submit' name='btnDelete' value='Delete'>  </form>" . "<br>";
    }
} else 
{
    echo "0 results";
}
$db->close();

?>

Angesehen
  • 301
  • 2
  • 16
  • 1
    Your code is vulnerable to SQL injection attacks. You should use [**mysqli**](https://secure.php.net/manual/en/mysqli.prepare.php) or [**PDO**](https://secure.php.net/manual/en/pdo.prepared-statements.php) prepared statements with bound parameters as described in [**this post**](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php). – Alex Howansky Apr 14 '17 at 01:52
  • what does error reporting show and error handling on the queries? you're not checking for real possible errors. Your code isn't all properly indented, so it's hard to say if your heredoc didn't fail also. I'm betting on a parse error. – Funk Forty Niner Apr 14 '17 at 02:18
  • Your query also failed on an unquoted value for `$Position` since that is a string. – Funk Forty Niner Apr 14 '17 at 02:20
  • Easy way would be to print out your sql query to screen. Copy it and run it in mysql on command line or a tool like phpMyadmin or mysql workbench. hi @Fred-ii- lol – TurtleTread Apr 14 '17 at 02:22
  • 1
    that is a good idea I didn't think to do that! thank you @TurtleTread – Angesehen Apr 14 '17 at 12:02
  • 1
    @Fred-ii- When i do error checking and reporting I get no errors, there are no syntax errors or anything that it finds, which is why I'm so lost as to why it wont work properly. – Angesehen Apr 14 '17 at 12:46
  • You are missing quotes for the "position" html name attributes – TurtleTread Apr 14 '17 at 13:30
  • 1
    @TurtleTread I actually saw fixed that and still doesn't work sadly – Angesehen Apr 14 '17 at 14:24
  • can you print your sql query from the script? let's take a took – TurtleTread Apr 14 '17 at 15:27
  • 1
    Never actually figured this out, just gave up – Angesehen Aug 16 '17 at 18:59

0 Answers0