My form is not connecting with server code is here

Question

Error: INSERT INTO mydata (name,email,Password) VALUES (ali, hyder@gmail.com,alihyder) You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '@gmail.com,alihyder)' at line 2

<?php
$servername = "localhost";
$username = "root";
$password = "";
$dbname = "mydb";

// Create connection
$conn = mysqli_connect($servername, $username, $password, $dbname);
// Check connection
if (!$conn) {
    die("Connection failed: " . mysqli_connect_error());
}
if(isset($_POST['register-user'])) {
    $name = $_POST['username'];
    $email = $_POST['email'];
    $password = $_POST['password'];
    $sql = "INSERT INTO mydata (name,email,Password)
            VALUES ($name, $email,$password)";

    mysqli_query($conn, $sql);

    if (mysqli_query($conn, $sql)) {
        echo "New record created successfully";
    } else {
        echo "Error: " . $sql . "<br>" . mysqli_error($conn);
    }

    mysqli_close($conn);


}

You need to enclose string values in quotes. Though if you use query parameters instead of executing user input as code then the problem becomes moot. This is a great reference to get you started: https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php — David, Nov 12 '17 at 11:53
Do not save the password in plain text, use `password_hash()` for saving and `password_verify()` for checking the password. — Progman, Nov 12 '17 at 13:02
Can you write any example basically i am little bit begnier. so hard to understand what is write. — Lucky Boy, Nov 12 '17 at 13:09

score 1 · Accepted Answer · answered Nov 12 '17 at 11:59

1

Instead use mysqli_prepare

$stmt = mysqli_prepare($conn, "INSERT INTO mydata(name,email,Password) VALUES (?, ?, ?)");
mysqli_stmt_bind_param($stmt, "sss", $name, $email,$password);
mysqli_stmt_execute($stmt);

answered Nov 12 '17 at 11:59

Niklesh Raut

34,013
16
75
109

This mean that code i am using in php is not secure i need to use mysqli_prepare – Lucky Boy Nov 12 '17 at 12:34
Yes dear @LuckyBoy – Niklesh Raut Nov 12 '17 at 12:35
but this code is giving an error . Can you guide me code is here. – Lucky Boy Nov 12 '17 at 12:41
– Lucky Boy Nov 12 '17 at 12:41
I edit my code please check my code and guide me dear – Lucky Boy Nov 12 '17 at 12:43
@LuckyBoy: What error you are getting ? Did you forget to close } for if condtion ? – Niklesh Raut Nov 12 '17 at 12:47

My form is not connecting with server code is here

1 Answers1