0

I have some problem with my code

it show

Warning: mysqli_query() expects parameter 1 to be string, resource given in C:\xampp\htdocs\ujilevel\create-proses.php on line 7

if i change mysqli into mysql it will show same problem

before it i will show my config.php

$host ="localhost";
$user ="root";
$password="";
$database="portal-berita";
$koneksi=mysql_connect($host,$user,$password) or die("Koneksi error");
mysql_select_db($database,$koneksi) or die("Database tidak ditemukan"); 

<?php
include "config.php";
if(isset($_POST['simpan'])){
$judul=$_POST['judul'];
$isi=$_POST['isi'];
$penulis=$_POST['penulis'];
$query=mysqli_query($koneksi,"INSERT INTO berita VALUES('','$judul','$isi','','$penulis')");

if($query){
        echo"<script> alert('Data Berhasil Ditambahkan !');</script>";
        die("<script>location.href='home-create.php'</script>");
    }

    else{
        echo "<script> alert('Data Gagal Ditambahkan !');</script>";
    }
}
?>

line 7 is $query=mysql_query($koneksi,"INSERT INTO berita VALUES('','$judul','$isi','','$penulis')");

And this is my form

<form method="POST" action="create-proses.php">
    <h2 class="card-title" >JUDUL</h2>
    <input type="text" class="form-control" id="judul" name="judul" >
    <br>
    <h2 class="card-text">ISI</h2>
    <textarea class="form-control" rows="5"  name="isi"></textarea>
    <br>
    <h2 class="card-text">AUTHOR</h2>
    <input type="text" class="form-control" id="penulis" name="penulis" >
    <br>
    <div class="col-sm-4">
    <input type="submit" class="btn btn-primary" name="simpan" value="SUBMIT">
</form>
Sheva Athalla
  • 11
  • 1
  • 2
  • What is in `$_POST['judul']`? – deEr. Apr 24 '18 at 06:20
  • **You are wide open to [SQL Injections](http://php.net/manual/en/security.database.sql-injection.php)** and should really use [Prepared Statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) instead of concatenating your queries. Specially since you're not escaping the user inputs at all! – M. Eriksson Apr 24 '18 at 06:21
  • 1
    from where you get `$koneksi`? it needs to be database connection object. – Alive to die - Anant Apr 24 '18 at 06:22
  • @AlivetoDie i think i include it on `include "config.php";` – Sheva Athalla Apr 24 '18 at 06:27
  • Show `config.php` page code too – Alive to die - Anant Apr 24 '18 at 06:29
  • @MagnusEriksson what do you mean? can u show me some examples? – Sheva Athalla Apr 24 '18 at 06:33
  • I think your connection attempt failed. Can you show the connection code also – Robert Apr 24 '18 at 06:33
  • 1
    remove `$koneksi=mysql_connect($host,$user,$password) or die("Koneksi error"); mysql_select_db($database,$koneksi) or die("Database tidak ditemukan");` and write `$koneksi=mysqli_connect($host,$user,$password,$database) or die("Koneksi error");` and then try again – Alive to die - Anant Apr 24 '18 at 06:34
  • Interesting that your code lists `mysqli_query` and matches the parameters your using and yet your error shows `mysql_query` BUT still with the parameters for `mysqli_query` – Nigel Ren Apr 24 '18 at 06:35
  • You should try and update to mysqli_ if possible. Or move to PDO if you prefer. Either is better than sticking with mysql_. – Nigel Ren Apr 24 '18 at 06:36
  • @ShevaAthalla remove `$koneksi=mysql_connect($host,$user,$password) or die("Koneksi error"); mysql_select_db($database,$koneksi) or die("Database tidak ditemukan");` and write `$koneksi=mysqli_connect($host,$user,$password,$database) or die("Koneksi error");` and then try again – Alive to die - Anant Apr 24 '18 at 06:36
  • @AlivetoDie it show same error – Sheva Athalla Apr 24 '18 at 06:39
  • read [this](https://www.w3schools.com/php/func_mysqli_select_db.asp) and [this](https://www.w3schools.com/php/func_mysqli_query.asp) – hungrykoala Apr 24 '18 at 06:53
  • Read the links I posted in my first comment and you'll see some examples and an explanation about what I mean. – M. Eriksson Apr 24 '18 at 11:20

0 Answers0