-1

I'm a student studying web programming im trying to display some of information from my db table which are(name, date, dll), all of the information are displayed perfectly except my id number from the db table and also there are no error so its hard for me to detect what i did wrong. can anyone see what i did wrong in my coding and explain what have i missed?

for further reference this is my php coding:

<?php   

$con = mysql_connect("localhost", "root", "");
mysql_select_db("tempahperalatan");


if(isset($_POST['hantar']))
{

    $noID = 'noID';
    $pemohon = $_POST['pemohon'];
    $trkhMula = $_POST['trkhMula'];
    $trkhAkhir = $_POST['trkhAkhir'];
    $n_program = $_POST['n_program'];
    $lokasi = $_POST['lokasi'];
    $n_anjuran = $_POST['n_anjuran'];
    $catatan = $_POST['catatan'];
    $masa = $_POST['masa'];
    $t_Log = $_POST['t_Log'];
    $modified_date;
    $modified_time;

$sql = "INSERT INTO daftartempah (pemohon, trkhMula, trkhAkhir, n_program, lokasi, n_anjuran, catatan, modified_date, modified_time) VALUES ('$pemohon', '$trkhMula', '$trkhAkhir', '$n_program', '$lokasi', '$n_anjuran', '$catatan', CURDATE(), CURTIME())";  
$res = mysql_query($sql);   
}

    $viewPerson = "SELECT * FROM daftartempah";
    $viewPersonRes = mysql_query($viewPerson);

?>

and this is a table im trying to display some of my info from my db table:

<?php


while($row = mysql_fetch_array($viewPersonRes)){

    echo "<tr>";
        echo "<td".$row['noID']."</td>";
        echo "<td>".$row['trkhMula']."</td>";
        echo "<td>".$row['modified_time']."</td>";
        echo "<td>".$row['n_program']."</td>";
        echo "<td>".$row['pemohon']."</td>";
        echo "<td>".$row['n_anjuran']."</td>";
        echo "<td>".$row['lokasi']."</td>";
        echo "<td>".$row['catatan']."</td>";
    echo "</tr>";
}
?>

my table name from my db is: daftartempah

thank you in advance, your help is much needed :)

Funk Forty Niner
  • 74,450
  • 15
  • 68
  • 141
user8674032
  • 51
  • 3
  • 9
  • You mean `$row['noID']` is empty? You never use `$noID` on your insert, is that field auto-incrementing? You also are open to SQL injections. You should parameterize the query. (After you upgrade your driver from `mysql_` to `PDO` or `mysqli`) – chris85 Sep 28 '17 at 01:21
  • mysql is depreciated. Use `mysqli`or PDO. – StackSlave Sep 28 '17 at 01:24
  • yes that field is auto-increment. can you explain more about parameterizing my query? thankyou – user8674032 Sep 28 '17 at 01:30
  • you're not checking for errors, do you not know how? – Funk Forty Niner Sep 28 '17 at 01:34
  • [Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)***. Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! – Jay Blanchard Sep 28 '17 at 12:36
  • ***Please [stop using `mysql_*` functions](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php).*** [These extensions](http://php.net/manual/en/migration70.removed-exts-sapis.php) have been removed in PHP 7. Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [PDO](http://php.net/manual/en/pdo.prepared-statements.php) and [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) and consider using PDO, [it's really pretty easy](http://jayblanchard.net/demystifying_php_pdo.html). – Jay Blanchard Sep 28 '17 at 12:36

1 Answers1

1

You have a missing closure for your <td> tag.

echo "<td".$row['noID']."</td>";
         ^ right there.

That's why it's not displaying.

Therefore:

echo "<td>".$row['noID']."</td>";

and looking at your developer console and the HTML source would have shown you something about it.

Make sure that you also have the opening and closing <table> - </table> tags. That's unknown.

You're also practicing with an outdated API, which isn't good practice to begin with.

Use either the mysqli_ or PDO API for "this century".

You're also open to an serious SQL injection; use a prepared statement:

Funk Forty Niner
  • 74,450
  • 15
  • 68
  • 141