0

I want to start by saying i tried atleast 10 different solutions on this site, but none worked in my case so i was wondering if you guys could help me figure out what's wrong.

Form:

    <form align="center" action=includes/signup.php method="post">
        <input type="text" id="fname" name="fname" placeholder="First Name"><br>
        <input type="text" id="lname" name="lname" placeholder="Last Name"><br>
        <input type="text" id="uname" name="uname" placeholder="Username"><br>
        <input type="text" id="email" name="email" placeholder="Email"><br>
        <input type="text" id="phone" name="phone" placeholder="Phone Number"><br>
        <button type="submit" value="submit" name="submit" name="save"> Add To Database </button>
    </form>

signup.php

<?php
include_once 'dbh.php';



$fname = $_POST['fname'];
$lname = $_POST['lname'];
$uname = $_POST['uname'];
$email = $_POST['email'];
$phone = $_POST['phone_no'];



$sql = "INSERT INTO `users` (f_name, l_name, username, email, phone_no) 
        VALUES ('$fname', '$lname', '$uname', '$email', '$phone');";

if (!mysqli_query($conn, $sql)) {
        echo 'Not Inserted';
} else {
        echo 'inserted';
}

header("refresh:3; url=../index.php?add=success");

My problem is that everytime i press the button, i get "Not Inserted", but when i changed the values from "$fname" to "David", David got inserted into the database. Which means the data from the form is not being received by this page.

I am using VS Code incase that makes a difference.

Emon Hoque
  • 5
  • 3
  • 1
    You don't know what's wrong because you don't check for errors in your code. Never assume the code is always going to work flawlessly. Use [`mysqli_error()`](http://php.net/manual/en/mysqli.error.php) to get a detailed error message from the database. – John Conde Jun 24 '20 at 14:25
  • 1
    Please read about **[SQL injection](https://en.wikipedia.org/wiki/SQL_injection)**. Instead of building queries with string concatenation, use **[prepared statements](https://secure.php.net/manual/en/pdo.prepare.php)** with **[bound parameters](https://secure.php.net/manual/en/pdostatement.bindparam.php)**. See **[this page](https://phptherightway.com/#databases)** and **[this post](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)** for some good examples. – John Conde Jun 24 '20 at 14:25

0 Answers0