Data won't pass into Database (PHP)

Question

My form won't post inserted data into my database, i know this is a very basic problem but I am only just starting to learn to code

connect_to_mysql.php:

 <?php
    $db_host="localhost";
    $db_username="ajamesbird";
    $db_pass="";
    $db_name="test";

    $db_connect = mysql_connect("$db_host","$db_username","$db_pass")or die 
    ("could not connect to mysql");
    mysql_select_db("$db_name") or die ("no database");

    ?>

login.php

<html>
<?php include "C:\Users\andrew\Documents\Websites\Seller\storescripts\connect_to_mysql.php";?>
<?php
if(isset($_POST['loginform'])){
  $username = $_POST['username'];
  $firstname = $_POST['firstname'];
  $lastname = $_POST['lastname'];
  $password = $_POST['password'];
  $email = $_POST['email'];
  $dob = $_POST['dob'];

 $sql = ("INSERT INTO users (id, access_level, username, firstname, 
 lastname, email, password, dob, date_added, activated)
        VALUES ('NULL','NULL','$username','$firstname','$lastname','$email', '$password', '$dob', now(), '0')") or die (mysql_error());
    if(!mysql_query($db_connect, $sql)){
        die('Error inserting into database');
}
}
?>
<head>
<link href="style/css.css" rel="stylesheet" type="text/css">
</head>
<body>
    <form action="login.php" enctype="multipart/form-data" name="loginform" id="loginform" method="post">
    <input name="username" type="text" id="username" size="63" class="form-control" value="Username" required/>
    <input name="firstname" type="text" id="firstname" size="63" class="form-control" value="First name" required/>
    <input name="lastname" type="text" id="lastname" size="63" class="form-control" value="Last name" required/>
    <input name="email" type="email" id="email" size="63" class="form-control" value="Email" required/>
    <input name="password" type="password" id="password" size="63" class="form-control" value="Password" required/>
    <input name="dob" type="text" id="dob" size="63" class="form-control" value="Date of Birth" required/>
    <input type="submit" name="button" id="button"  size="64" value="Sign Up" />
    </form>
</body>
</html>

Thank you in advance

is this `if(!mysql($db_` your real code? or just a typo here? I suppose you've ment `mysql_query($db...)` __BUT__ don't use `mysql_*` functions anymore!! They are old, deprecated, unsecure and _removed in php7_. Use mysqli_* or PDO. — Jeff, Oct 19 '17 at 20:41
You're also not protecting against SQL injection attacks. Anything going into your SQL queries needs to be properly sanitized, or better yet, use prepared statements with bound parameters. — Mike, Oct 19 '17 at 20:45
Yes that was a typo, my mistake but my code still doesn't work — Andrew Bird, Oct 19 '17 at 20:45
If you [had PHP errors being displayed](https://stackoverflow.com/questions/1053424/how-do-i-get-php-errors-to-display) you would notice that you have the parameters to `mysql_query()` inverted. — Mike, Oct 19 '17 at 20:48
**Never store plain text passwords!** Please use ***PHP's [built-in functions](http://jayblanchard.net/proper_password_hashing_with_PHP.html)*** to handle password security. If you're using a PHP version less than 5.5 you can use the `password_hash()` [compatibility pack](https://github.com/ircmaxell/password_compat). ***It is not necessary to [escape passwords](http://stackoverflow.com/q/36628418/1011527)*** or use any other cleansing mechanism on them before hashing. Doing so *changes* the password and causes unnecessary additional coding. — Jay Blanchard, Oct 19 '17 at 20:51

score 0 · Answer 1 · answered Oct 19 '17 at 21:06

Try to move name="loginform" from and put it in hidden input

<html>
<?php include "C:\Users\andrew\Documents\Websites\Seller\storescripts\connect_to_mysql.php";?>
<?php
if(isset($_POST['loginform'])){
  $username = $_POST['username'];
  $firstname = $_POST['firstname'];
  $lastname = $_POST['lastname'];
  $password = $_POST['password'];
  $email = $_POST['email'];
  $dob = $_POST['dob'];

 $sql = ("INSERT INTO users (id, access_level, username, firstname, 
 lastname, email, password, dob, date_added, activated)
        VALUES ('NULL','NULL','$username','$firstname','$lastname','$email', '$password', '$dob', now(), '0')") or die (mysql_error());
    if(!mysql_query($db_connect, $sql)){
        die('Error inserting into database');
}
}
?>
<head>
<link href="style/css.css" rel="stylesheet" type="text/css">
</head>
<body>
    <form action="login.php" enctype="multipart/form-data" method="post">
    <input name="username" type="text" id="username" size="63" class="form-control" value="Username" required/>
    <input name="firstname" type="text" id="firstname" size="63" class="form-control" value="First name" required/>
    <input name="lastname" type="text" id="lastname" size="63" class="form-control" value="Last name" required/>
    <input name="email" type="email" id="email" size="63" class="form-control" value="Email" required/>
    <input name="password" type="password" id="password" size="63" class="form-control" value="Password" required/>
    <input name="dob" type="text" id="dob" size="63" class="form-control" value="Date of Birth" required/>
    <input type="submit" name="button" id="button"  size="64" value="Sign Up" />
    <input type="hidden" name="loginform">
    </form>
</body>
</html>

re-read the comments! There's another important thing you've missed. — Jeff, Oct 19 '17 at 21:43
I know the issue about mysql_* instead of using mysqli_*, and that he store plain text password, plus he is not protected against SQL injection. But i was focused on the problem that the $_POST request is not working for him. Now when he fix that part he can focus on changing the code in connect_to_mysql.php and to re-do the login.php code :) — Sinisa, Oct 20 '17 at 09:33
still, `mysql_query($db_connect, $sql)` is just wrong and will throw an error. I'm talking about beeing deprecated. The params are switched. — Jeff, Oct 20 '17 at 11:46

Data won't pass into Database (PHP)

1 Answers1