Blank records being inserted into mysql

doctortim

I am trying to insert new records in the data base from my create_new form.

It "post"s to the insert_new file without (seemingly) a problem.

I check the database and a new record has been created, but all of its fields are blank.

So I seem to be connecting to the database but some how my post global array is not is not picking up what has been inputted into the form fields.

What could be causing this ?? (I saw it work earlier so no probs with installation etc (( made come changes to file, and not worked since)). also after everything I tried failed: went into php.ini and register_globals = turned it on)

Could it be something else I have not thought of?

Kudose

Post some code

doctortim

Ok, well here is the create_new form

<form id="pro_blog_form" name="pro_blog_form" method="post" action="pro_blog_insert_new.php">

<table width="702" border="0">
  <tr>
    <td colspan="6" align="left" valign="top"><table width="696" border="0">
      <tr>
        <td colspan="2"><span class="style13"><span class="style4">BLOG - CREATE NEW ENTRY</span></span></td>
        </tr>
      <tr>
        <td width="332" height="53"><span class="style13"><span class="style9"><br />
Action: </span><span class="style12">Create</span><br />
<span class="style9">Environment:</span> <span class="style10">Professional</span></span></td>
        <td width="354" align="left" valign="bottom"><input type="submit" name="insert" id="insert_button" value="Submit New Blog Entry" /></td>
      </tr>
    </table>
      </td>
    </tr>
  <tr>
    <td width="13">&nbsp;</td>
    <td width="295">&nbsp;</td>
    <td width="23">&nbsp;</td>
    <td width="293">&nbsp;</td>
    <td width="4">&nbsp;</td>
    <td width="10">&nbsp;</td>
  </tr>
  <tr>
    <td>&nbsp;</td>
    <td colspan="2"><span class="style13">
      <label></label>
    </span>
      <label></label>
      <label><span class="style8">Blog Issue Number<br />
      <br />
      <input name="issue_no" input="input" type="text" id="issue_no" size="8" />
      </span></label></td>
    <td colspan="3"><span class="style8">Blog Issue Date<br />
        <br />
        <input name="issue_date" input="input" type="text" id="issue_date" />
    </span></td>
    </tr>
  <tr>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
  </tr>
  <tr>
    <td>&nbsp;</td>
    <td><span class="style8"> Focus<br />
<br />
<textarea name="focus" id="focus" cols="45" rows="5"></textarea>
    </span></td>
    <td>&nbsp;</td>
    <td><span class="style8">Contents<br />
        <br />
        <textarea name="toc" id="toc" cols="45" rows="5"></textarea>
    </span></td>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
  </tr>
  <tr>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
  </tr>
  <tr>
    <td>&nbsp;</td>
    <td colspan="3"><span class="style8">Article<br />
        <br />
        <textarea name="article" id="article" cols="100" rows="8"></textarea>
    </span></td>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
  </tr>
  <tr>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
  </tr>

  <tr>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
    <td>&nbsp;</td>
  </tr>
</table>
<p align="left"><label></label>
</p>
</form>

And here is the php I'm using in the insert file

<?php include_once("include/connect_sql.inc.php"); ?>
<?php
	// Retreiving Form Elements from Form
	$issue_no = addslashes($_REQUEST['issue_no']);
	$issue_date = addslashes($_REQUEST['issue_date']);
	$focus = addslashes($_REQUEST['focus']);
	$toc = addslashes($_REQUEST['toc']);
	$article = addslashes($_REQUEST['article']);

$sqlQuery = "INSERT INTO blogprofessional (issue_no, issue_date, focus, toc, article, created )
	VALUES ('$issue_no' , '$issue_date' , '$focus' , '$toc' , '$article' , NOW());";
$result = mysql_query($sqlQuery);
?>

Kudose

Is there any data in the POST superglobal, instead of the REQUEST?

bradgrafelman

I would suggest first changing $REQUEST to $POST (I never use $_REQUEST - I'd rather know where the data is coming from).

Then, add some code in your PHP script to check if it has data to process first. As it is, if I visit the PHP page (or a webcrawler hits it), your script will insert blank data. Instead, you should check if there's any need to run a SQL query, such as:

if(!empty($_POST)) {
    // process stuff here
}

EDIT: Also note that when sanitizing data for MySQL queries, you should not use [man]addslashes/man but instead use [man]mysql_real_escape_string/man.

doctortim

I tired changing the request's to post, didn't change anything.

Any other suggestions?

(Also can you explain a bit more about checking if there's any need to run a SQL query?)

rincewind456

You should go back into your php.ini and turn register_globals off

You should also add some error reporting to your sql query like

$result = mysql_query($sqlQuery) or die(mysql_error().' for query '. $sqlQuery);

You should also check to see if the POST actually has any data like

print_r($_POST);

at the top of you processing page.

bradgrafelman

doctortim wrote:
I tired changing the request's to post, didn't change anything.

Any other suggestions?

The suggested fix wasn't to use $_POST instead - that was just a suggested improvement.

The fix was to check if there is POSTed data before running the query, as I explained in my above post.

doctortim wrote:
(Also can you explain a bit more about checking if there's any need to run a SQL query?)

Well, you essentially wrap the code that does all of the SQL processing in an if() statement such as the one in the code snippet I posted above.

benracer

<?php 
    // Retreiving Form Elements from Form 
  if(!empty($_POST['issue_no'])) { //some variable that must always contain avalue
   $issue_no = addslashes($_POST['issue_no']); 
    $issue_date = addslashes($_POST['issue_date']); 
    $focus = addslashes($_POST['focus']); 
    $toc = addslashes($_POST['toc']); 
    $article = addslashes($_POST['article']); 

$sqlQuery = "INSERT INTO blogprofessional (issue_no, issue_date, focus, toc, article, created ) 
    VALUES ('$issue_no' , '$issue_date' , '$focus' , '$toc' , '$article' );"; 
$result = mysql_query($sqlQuery); 
}else{
//do stuff here
}
?>