PHP and mysql not INSERTing

Question

<html>
<head>
<title> Register </title>
</head>
<body>

Thanks for showing interest, please register below.
<br>


<br/>
<form action="register.php" method="POST">
Username: <input type="text" name="username">
<br>

</br>
Password: <input type="password" name="password">
<br>

</br>
Age:      <input type="text" name="age">
<br>

</br>
Car:      <input type="text" name="car">
<br>


<input type="submit" value="register"/>
<input type="reset" value="Reset fields"/>
</form>

<?php

    //db connect
    $host="localhost"; 
    $dbuser="site1login";
    $dbpass="site1login";
    $dbname="login";
    $tblname="userdata";

    //form post
    $Username=$_POST['username'];
    $Password=$_POST['password'];
    $Age=$_POST['age'];
    $Car=$_POST['car'];
    $con = mysql_connect("$host","$dbuser","$dbpass") or die (mysql_error());

    mysql_select_db($dbname, $con);

    $result = mysql_query("INSERT INTO `userdata` (Username,Password,Age,Car) VALUES ($Username, $Password, $Age, $Car)" or die(mysql_error()));
    echo "Success!";

?>

</body>

</html>

So, that's my code - I'm confused - it doesn't work - it says "success", but not inserted e anything

While singles' answer is the correct one, I suggest you echo out the insert statement in the future. It would be pretty obvious right away that the statement was incorrectly formatted. — clifgriffin, Feb 14 '11 at 18:59
You also need to check for a submittion, it tries to submit when you first go to the form. — mikelbring, Feb 14 '11 at 19:00
Why was this voted down? If I have an error - tell me, it's my question - don't just vote down — Barrie Reader, Feb 22 '11 at 16:27

MD Sayem Ahmed · Accepted Answer · 2011-02-15T13:15:55.347

Change the following portion -

$result = mysql_query("INSERT INTO `userdata` (Username,Password,Age,Car) VALUES 
             ($Username, $Password, $Age, $Car)" or die(mysql_error()));
echo "Success!";

into this -

$result = mysql_query("INSERT INTO userdata (Username,Password,Age,Car) VALUES 
          ('$Username', '$Password', '$Age', '$Car')");

if($result)
{
    echo "Success!";
}
else
{
    die(mysql_error());    // Thanks to Pekka for pointing this out.
}

If the above doesn't work, try checking if your connection parameters are ok and if MySQL is running.

Also you should test the $resut value to check whether any successful query execution has occured -

if($result)
{
    // Successful query execution
}
else
{
    // Some error occured while executing query.
    // Show some useful information using echo/print.
    // Then stop execution after taking other necessary steps
}

Edit

As Pekka has mentioned, your database is vulnerable to SQL Injection attack since you are not sanitizing your input. You should use at least mysql_real_escape_string method to ensure that this doesn't occur.

Hey there, thanks very much! that works but I `$result` doesn't exist after the query — Barrie Reader, Feb 14 '11 at 19:02
@Neurofluxation: See the edited version and try it. I think it should work now. — MD Sayem Ahmed, Feb 14 '11 at 19:08

score 4 · Answer 2 · edited May 23 '17 at 12:29

4

As others have noted before me, you are missing quotes around the field values. Also, this construction is severely flawed:

$result = mysql_query("INSERT INTO `userdata` (Username,Password,Age,Car) 
          VALUES ($Username, $Password, $Age, $Car)" or die(mysql_error()));

the or die is inside the query parameter. Not sure how that can work at all.

Remove the or die part and do error handling like so:

$result = mysql_query("INSERT INTO `userdata` (Username,Password,Age,Car) 
          VALUES ('$Username', '$Password', '$Age', '$Car')");

if (!$result) 
 die("SQL Error: ".mysql_error());

echo "Success";

Also

Your script is vulnerable to SQL injection
Your script will always be executed, regardless whether the form was submitted or not - you want to change that to prevent getting empty records

edited May 23 '17 at 12:29

Community

1
1

answered Feb 14 '11 at 19:00

Pekka

442,112
142
972
1,088

Odd, though, he's got the mysql_error stuff at the end of the query - that should have spit out a syntax error at minimum, given the missing quotes. – Marc B Feb 14 '11 at 20:17
@Marc nope, because the expression inside the brackets was ` OR die`. The `` portion would always evaluate to `true`, satisfying the condition, so the interpreter would never even look at the die() statement. The query got executed, and crashed with an error. This is why `or die()` constructions are a bad thing – Pekka Feb 14 '11 at 20:19
Ah yeah, missed the missing bracket. – Marc B Feb 14 '11 at 20:29

Radek Benkel · Answer 3 · 2011-02-14T19:12:48.987

1

I suppose, that Username, Password and Car are strings so it should be:

$result = mysql_query("INSERT INTO `userdata` (Username,Password,Age,Car) VALUES ('$Username', '$Password', $Age, '$Car')") or die(mysql_error();

Good advice - try using PDO ;)

edited Feb 14 '11 at 19:12

answered Feb 14 '11 at 18:57

Radek Benkel

8,278
3
32
41

score 0 · Answer 4 · answered Feb 14 '11 at 18:56

0

You need to surround your variables with '' so the SQL will be correct.

answered Feb 14 '11 at 18:56

Kaj Ström

71
5

score 0 · Answer 5 · answered Feb 14 '11 at 19:01

0

In your VALUES statement, you need to wrap the $Username in a single quote.

VALUES ('$Username', '$Password', $Age, '$Car')"

Also, I would remove the or die statement from your call. Then, I would test the $result in a if statement.

if ($result)

answered Feb 14 '11 at 19:01

Neil Knight

47,437
25
129
188

PHP and mysql not INSERTing

5 Answers5

Linked