0

I am running through a problem and can't find an explanation. I created a small form in order to insert data into an SQL database.

The code works fine on localhost, and gives me no error when uploaded to Godaddy (Cpanel), but shows empty field once the form is submitted. Only the Primary key (ID in my case which is Auto increment) Appears.

I also tried to echo before sending to the SQL code and seems to print all the values right.

Below is my code

Index.php 

<div class="one_half">
<input class="field" required type="text" name="name" id="name" placeholder="First Name"></div>
<div class="one_half">
<input class="field" required type="text" name="lastname" id="lastname" placeholder="Last Name"></div>
<div class="one_third">
<input class="field" required type="text" name="phone" id="phone" placeholder="Phone"></div>
<div class="one_third">
<input class="field" type="email" name="email" id="email" placeholder="Email"></div>
<div class="one_third">
<input class="field" required type="text" name="dateofbirth" id="dateofbirth" placeholder="Date of Birth"></div>
<div class="one_half">
<input class="field" required type="text" name="carmodel" id="carmodel" placeholder="Car Model"></div>
<div class="one_half">
<input class="field" required type="text" name="caryear" id="caryear" placeholder="Car Year"></div>
<div class="one_half">
<input class="field" required type="text" name="platenumber" id="platenumber" placeholder="Plate Number"></div>
<div class="one_half">
<input class="field" required type="text" name="platenumbercode" id="platenumbercode" placeholder="Plate Number Code"></div>
<div class="one">
<input class="field" required type="text" name="cardnumber" id="cardnumber" placeholder="Card Number"></div>
<div class="one_half">
<input class="field" required type="text" name="tiresize" id="tiresize" placeholder="Tire Size"></div>
<div class="one_half">
<input class="field" required type="text" name="tirepattern" id="tirepattern" placeholder="Tire Pattern"></div>
<div class="one">
<input class="field" required type="text" name="dealername" id="dealername" placeholder="Dealer Name"></div>
<input class="submit" type="submit">
</form>

Submit.php

<?php
include "connect.php";
?>

<?php
$name = mysql_real_escape_string($_REQUEST['name']) ;
$lastname = mysql_real_escape_string($_REQUEST['lastname']) ;
$phone = mysql_real_escape_string($_REQUEST['phone']) ;
$email = mysql_real_escape_string($_REQUEST['email']) ;
$dateofbirth = mysql_real_escape_string($_REQUEST['dateofbirth']) ;
$carmodel = mysql_real_escape_string($_REQUEST['carmodel']) ;
$caryear = mysql_real_escape_string($_REQUEST['caryear']) ;
$platenumber = mysql_real_escape_string($_REQUEST['platenumber']) ;
$platenumbercode = mysql_real_escape_string($_REQUEST['platenumbercode']) ;
$cardnumber = mysql_real_escape_string($_REQUEST['cardnumber']) ;
$tiresize = mysql_real_escape_string($_REQUEST['tiresize']) ;
$tirepattern = mysql_real_escape_string($_REQUEST['tirepattern']) ;
$dealername = mysql_real_escape_string($_REQUEST['dealername']) ;


?>

<?php

$sql = "INSERT INTO `insurance` (`ID`, `name`, `lastname`, `phone`, `email`, `dateofbirth`, `carmodel`, `caryear`, `platenumber`, `platenumbercode`, `cardnumber`, `tiresize`, `tirepattern`, `dealername`) VALUES (NULL, '$name', '$lastname', '$phone', '$email', '$dateofbirth', '$carmodel', '$caryear', '$platenumber', '$platenumbercode', '$cardnumber', '$tiresize', '$tirepattern', '$dealername')";

if ($conn->query($sql) === TRUE) {
    echo "Card Successfully Registered... Redirecting";
} else {
    echo "Error updating record: " . $conn->error;
}

$conn->close();
?>

Connect.php "; $password = ""; $dbname = "*";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
} 
?>
Qirel
  • 25,449
  • 7
  • 45
  • 62
Pierre Irani
  • 805
  • 5
  • 19
  • Please do *not* abuse the snippet tools. That is for HTML/CSS/Javascript *only*. – John Conde Aug 29 '17 at 12:29
  • My apologies @JohnConde – Pierre Irani Aug 29 '17 at 12:32
  • You're already using an API that supports **prepared statements** with bounded variable input, you should utilize parameterized queries with placeholders (prepared statements) to protect your database against [SQL-injection](http://stackoverflow.com/q/60174/)! Get started with [`mysqli::prepare()`](http://php.net/mysqli.prepare) and [`mysqli_stmt::bind_param()`](http://php.net/mysqli-stmt.bind-param). Remove the escape functions, and use prepared statements. – Qirel Aug 29 '17 at 12:41
  • Thank you, I will explore with this @Qirel – Pierre Irani Aug 29 '17 at 13:17
  • @Qirel Please can you type your answer in the answer section so I can mark it as right answer and thank you so much for the guidance. – Pierre Irani Aug 29 '17 at 13:29
  • Your question was closed as a duplicate (because you were originally mixing APIs), so there's no possibility for adding a new answer. But if you found a solution, nothing's better! ;-) – Qirel Aug 29 '17 at 13:46

0 Answers0