Please help with register_globals off

basemansix8

I cant figure this out, Im a newbie. This has stumped me.

If I can figure it out with this example I think Ill understand how to do it for others. Simple Example. Submitting test to be inserted into MySQL.

HTML

<html>
<head>
<title>insert record</title>
</head>

PHP

$conn = mysql_connect("localhost", "user", "password");
mysql_select_db("test",$conn);

$sql= "insert into jason1 values ('9','$testfield')";

$result = mysql_query($sql,$conn) or die(mysql_error());
echo $result;

cschotch

Here is the form

<html> 
<head> 
<title>insert record</title> 
</head> 

<body> 
<form action="dbtest.php" method="get"> 
<P> text to add:<br> 
<input type="text" name="testfield" size=4> 
<p><input type="submit" name="submit" value="insert record"></p> 
</form> 
</body> 
</html>

and here is the php

<?php

$conn = mysql_connect("localhost", "username", "password"); 
mysql_select_db("db_name",$conn); 

/* This insert is towards a table with only 2 fields
ID   smallint(14) primary key
and a 
testfield   varchar(32) 
depending on the table you have it might be a 
little different but I hope you get the idea*/


$sql = "INSERT INTO jason1 VALUES ('','$testfield')"; 

$result = mysql_query($sql,$conn) or die(mysql_error()); 
if($result)
	{
	echo 'It worked!';
	}
else
	{
	echo 'try, try again';
	}
?>

cahva

basemansix8 said that he has register_globals off, so it would not insert anything to table.

Use $_GET['testfield'] in your $sql instead of plain $testfield.

basemansix8

PHP look like this now:

$conn = mysql_connect("basemansix8", "base", "apollo13");
mysql_select_db("test",$conn);

$sql= "insert into jason1 values ('9',$_GET['testfield'])";

if (mysql_query($sql,$conn)) {
echo "record added!";
}else{
echo "something went wrong";
}

???

cahva

I just realized that you dont have any columns in your $sql. Put them and also put the $_GET['testfield'] in simple quotes.

field1 is the field where you are putting '9' and field2 is for $GET['testfield']. So rename the field1 and field2 to whatever fieldnames you have in your table.

$sql= "INSERT INTO jason1 (field1,field2) values ('9','".$_GET['testfield']."')";