HTML form not submitting data through php to my database

Question

I need help getting my HTML form to submit data to my database (mysql). The database connects fine and everything but it can't seem to bridge the data into the database. I'm using Notepad++ as my text editor and tester. This is for a project ahead of time in class, I need to understand how to do this for it.

HTML

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Add Record Form</title>
</head>
<body>
<form action="insert.php" method="post">
    <p>
        <label for="firstName">TechID:</label>
        <input type="text" name="techid" id="TechID">
    </p>
    <p>
        <label for="lastName">First Name:</label>
        <input type="text" name="firstname" id="FirstName">
    </p>
    <p>
        <label for="emailAddress">Last Name:</label>
        <input type="text" name="lastname" id="LastName">
    </p>
    <p>
        <label for="emailAddress">Phone:</label>
        <input type="text" name="phone" id="Phone">
    </p>
    <p>
        <label for="emailAddress">Email:</label>
        <input type="text" name="email" id="Email">
    </p>
    <p>
        <label for="emailAddress">State:</label>
        <input type="text" name="state" id="State">
    </p>
    <p>
        <label for="emailAddress">Address:</label>
        <input type="text" name="address" id="Address">
    </p>
    <p>
        <label for="emailAddress">Zipcode:</label>
        <input type="text" name="zipcode" id="Zipcode">
    </p>
    <p>
        <label for="emailAddress">Date:</label>
        <input type="text" name="date" id="Date" placeholder="EX: 2017-7-25">
    </p>
    <p>
        <label for="emailAddress">Course:</label>
        <input type="text" name="course" id="Course">
    </p>
    <p>
        <label for="emailAddress">Request:</label>
        <input type="text" name="request" id="Request">
    </p>
    <input class="submit" name="submit" type="submit" value="Insert">
</form>
</body>
</html>

PHP

<?php
$link = mysqli_connect("localhost", "root", "", "student_request");

if($link === false){
    die("ERROR: Could not connect. " . mysqli_connect_error());
}

if(isset($_POST['submit'])){ 
    $techid = $_POST['techid'];
    $firstname = $_POST['firstname'];
    $lastname = $_POST['lastname'];
    $phone = $_POST['phone'];
    $email = $_POST['email'];
    $state = $_POST['state'];
    $address = $_POST['address'];
    $zipcode = $_POST['zipcode'];
    $date = $_POST['date'];
    $course = $_POST['course'];
    $request = $_POST['request'];

    $sql = "INSERT INTO student (TECH_ID, FIRST_NAME, LAST_NAME, PHONE_NUM, EMAIL, STATE, ADDRESS, ZIPCODE, DATE, COURSE, REQUEST_TYPE) VALUES ('$techid','$firstname','$lastname','$phone','$email','$state','$address','$zipcode','$date','$course','$request')";
    if(mysqli_query($link, $sql)) {
        echo "Records inserted successfully.";
    } else {
        echo "ERROR: Could not able to execute $sql. " . mysqli_error($link);
    }
}
mysqli_close($link);
?>

Table structure of student table:-

CREATE TABLE `student` (
  `REQUEST_ID` int(255) NOT NULL,
  `TECH_ID` int(11) NOT NULL,
  `FIRST_NAME` varchar(255) NOT NULL,
  `LAST_NAME` varchar(255) NOT NULL,
  `PHONE_NUM` varchar(255) NOT NULL,
  `EMAIL` varchar(255) NOT NULL,
  `STATE` varchar(255) NOT NULL,
  `ADDRESS` varchar(255) NOT NULL,
  `ZIPCODE` varchar(255) NOT NULL,
  `DATE` date NOT NULL,
  `COURSE` varchar(255) NOT NULL,
  `REQUEST_TYPE` text NOT NULL
)

Your script is at risk of [SQL Injection Attack](https://stackoverflow.com/q/60174/5914775). Have a look at what happened to [Little Bobby Tables](http://bobby-tables.com/). Even [if you are escaping inputs, its not safe!](https://stackoverflow.com/q/5741187/5914775). Use [prepared parameterized statements](https://php.net/manual/en/mysqli.quickstart.prepared-statements.php) instead. — Tom Udding, May 26 '17 at 05:16
What happens? Does it give you an error or does it say "Records inserted successfully." without adding inserting it into the database? — Tom Udding, May 26 '17 at 05:17
I understand that, right now I'm just trying to learn how to make a simple form that inserts data into a database. One step at a time please. — , May 26 '17 at 05:17
When I test it on the the localhost it doesn't return any errors or anything. When I tested it just using the php instead of the html by manually putting in values, it successfully inserted data. — , May 26 '17 at 05:18
Neither "Records inserted successfully." nor "ERROR: Could not (...)" shows up? — Tom Udding, May 26 '17 at 05:23
That means there is a problem with `if(isset($_POST['submit'])){`, could you `var_dump()` `$_POST` (and add the output to your question)? — Tom Udding, May 26 '17 at 05:26
When I removed that if statement and I test the insert.php file on localhost it gives a bunch of "Notice: Undefined index: techid in C:\wamp64\www\insert.php on line 9" — , May 26 '17 at 05:40
That means your form doesn't POST (correctly) to `insert.php`. — Tom Udding, May 26 '17 at 05:42
The REQUEST_ID is not the problem. I tested inserting values into the table manually without the HTML form using just PHP. It increments correctly and inserts correctly. — , May 26 '17 at 05:47
@Donald you also have some problems with your HTML (especially your label elements). — Tom Udding, May 26 '17 at 05:54
@AlivetoDie I agree on the auto-increment part but if the form doesn't POST it doesn't even matter. — Tom Udding, May 26 '17 at 05:55
Your database is mysql, not phpmyadmin. That's just a (slightly clumsy) GUI for DB management. — Strawberry, May 26 '17 at 07:11

Pavan Baddi · Answer 1 · 2017-05-26T11:26:38.643

@Donald here and a similar example of you question. This will definitely help you.

Best of luck for your project

HTML code:

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Add Record Form</title>
</head>
<body>
<form action="insertrecords.php" method="post">
    <p>
        <label for="FirstName">First Name:</label>
        <input type="text" name="firstname" id="FirstName">
    </p>
    <p>
        <label for="LastName">Last Name:</label>
        <input type="text" name="lastname" id="LastName">
    </p>
    <p>
        <label for="Email">Email:</label>
        <input type="text" name="email" id="Email">
    </p>
    </p>
    <input class="submit" name="submit" type="submit" value="Insert">
</form>
</body>
</html>

PHP code: insertrecords.php

<?php
$servername = "localhost";
$username = "root";
$password = "";
$dbname = "demo";

// Create connection
$conn = mysqli_connect($servername, $username, $password, $dbname);
// Check connection
if (!$conn) {
    die("Connection failed: " . mysqli_connect_error());
}

if(isset($_POST['submit'])){

    //USE MYSQLI_REAL_ESCAPE_STRING() TO ESCAPE SINGLE QUOTES 
    // AND AGAINST SQL INJECTION      
    $firstname = mysqli_real_escape_string($conn, $_POST['firstname']);
    $lastname = mysqli_real_escape_string($conn, $_POST['lastname']);
    $email = mysqli_real_escape_string($conn, $_POST['email']);


    $sql = "INSERT INTO MyGuests (firstname, lastname, email)
    VALUES ('$firstname', '$lastname', '$email')";

    if (mysqli_query($conn, $sql)) {
        echo "New record created successfully";
    } else {
        echo "Error: " . $sql . "<br>" . mysqli_error($conn);
    }

    mysqli_close($conn);    
}
?>

I ALSO RECOMMEND YOU TO START LEARNING MYSQLI->PREPARED STATEMENT FOR MORE SAFER AGAINST SQL-INJECTION. HERE BELOW IS THE SAME EXAMPLE AS ABOVE BUT WITH MYSQLI->PREPARED STATEMENTS AND PARAMETERIZED QUERY.

<?php    
$sql = $conn->stmt_init();

    $query = "INSERT INTO MyGuests (firstname, lastname, email)
    VALUES (?,?,?)";

    if($sql->prepare($query)){
        $sql->bind_param('sss',$firstname,$lastname,$email);

        $sql->execute();

        echo "New record successfully inserted";
    }
    else
    {
        echo "Error inserting the record".$conn->error;
    }
?>

Try code .Feel free to ask questions

@Strawberry no need i know very well first read the question . he is new and doing class project . he need to know the basic of php and mysqli than he will learn the mysqli prepare statements. do not unnecessarily down post read the question first . — Pavan Baddi, May 26 '17 at 07:23
@Strawberry if i is not good at basic sql and php then what the heck he will learn sql injection . up post my post my answere is right — Pavan Baddi, May 26 '17 at 07:26
@Strawberry i have updated the answere and fixed the `sql injection` atleast remove the downvote now. the answere is correct if you don't do it the future visitors will think it is wrong and few may again downvote it. kindly requesting .... — Pavan Baddi, May 26 '17 at 11:29
@Strawberry thank you very much for upvoting my answere and i'm sorry for whatever i said — Pavan Baddi, May 26 '17 at 11:56

HTML form not submitting data through php to my database

1 Answers1