PHP not INSERTing into the table

[camdenite]

Hi, I am completely lost as to why this is not creating new info on to the db. The script submits as if I don't fill out the form I get the errors. If I do I just get a blank page an it doesn't update the db... Nothing in the error log. I have been through this script but I am lost as to why it doesn't work and why there are no errors - wierd. Please help.

Cheers,
Colin

<?php
   require_once ('mysql_connect.php'); // Connect to the db.

// Check if the form has been submitted.
if (isset($_POST['submitted'])) {

   $errors = array(); // Initialise error array.

   // Check for a page name.
   if (empty($_POST['heading'])) {
      $errors[] = 'You forgot to enter a Blog Header.';
   } else {
      $header = escape_data($_POST['heading']);
   }

   // Check for a page title.
   if (empty($_POST['first_para'])) {
      $errors[] = 'You forgot to enter a First Paragraph.';
   } else {
      $first_para = escape_data($_POST['first_para']);
   }

   // Check for Page Content.
   if (empty($_POST['entry'])) {
      $errors[] = 'You forgot to enter an Entry.';
   } else {
      $entry = escape_data($_POST['entry']);
   }

   if (empty($errors)) { // If everything's OK.

  // Create the page in the database.

  /* Check for an existing page with the same name.
  $query = "SELECT blog_id FROM blogb WHERE heading='$heading'";
  $result = mysql_query($query);
  if (mysql_num_rows($result) == 0) {  */

     // Make the query.
     $query = "INSERT INTO blogb (blog_id, date1, date2, heading, category_id, first_para, entry, more, image1, image2, image3, image4, pub2 ) VALUES ('$blog_id', '$date1', '$date2', '$heading', '$category_id', '$first_para', '$entry', '$more', '$image1', '$image2', '$image3', '$image4', '$pub2')";
     $result = @mysql_query ($query); // Run the query.
     if ($result) { // If it ran OK.

        // Redirect the page_created.php page.
        // Start defining the URL.
        $url = 'http://' . $_SERVER['HTTP_HOST'] . dirname($_SERVER['PHP_SELF']);

        // Check for a trailing slash.
        if ((substr($url, -1) == '/') OR (substr($url, -1) == '\\') ) {
           $url = substr ($url, 0, -1); // Chop off the slash.
        }

        // Add the page.
        $url .= '/blog_created.php';

        header("Location: $url");
        exit();

     } else { // If it did not run ok.
        $errors[] = 'The page could not be registered due to a system error. We appologise for any inconvenience.'; // Public message.
        $errors[] = mysql_error() . '<br /><br />Query: ' . $query; // Debugging message.
     }

  } else { // Page already exists.
     $errors[] = 'This page already exists.';
  }

   /* } // End of empty if (empty(errors)) IF. */


} else { // Form has not been submitted.

   $errors = NULL;

 } // End of main submit conditional.

// Begin the page now.
$page_title = 'Blog Creator';

if (!empty($errors)) { // Print any error messages.
   echo '<h1>Error!</h1>
   <p>The following error(s) occurred:<br />';
   foreach ($errors as $msg) { // Print each error.
      echo " - $msg<br />\n";
   }
   echo '</p><p>Please try again.</p>';
}

// Create the form.
echo '<form action="create_blog.php" method="post">
<table width="500px">
<tr>
<td>Date: <b>'.$row['date2'].'</b><br /></td></tr>
<tr>
<td>Heading: <br />
<input type="text" name="heading" size="70"  value="'.$row['heading'].'" />
</td>
</tr>
<tr>
<td>Category Code<br />
(enter 2-digit code from list on right):<br />
<input type="text" name="category_id" size="5"  value="'.$row['category_id'].'" /></td></tr>
<tr>
<td valign="top">First Paragraph: <br />
<textarea name="first_para" cols="60" rows="6" />'.$row['first_para'].'</textarea></td>
</tr>
<tr>
<td valign="top">Entry: <br />
<textarea name="entry" cols="60" rows="10" />'.$row['entry'].'</textarea></td>
</tr>
<tr>
<td valign="top">More: <br />
<textarea name="more" cols="60" rows="10" />'.$row['more'].'</textarea></td>
</tr>
<tr>
<td>First Image: <br />
<input type="text" name="image1" size="70"  value="'.$row['image1'].'" />
</td>
</tr>
<tr>
<td>Second Image: <br />
<input type="text" name="image2" size="70"  value="'.$row['image2'].'" />
</td>
</tr>
<tr>
<td>Third Image: <br />
<input type="text" name="image3" size="70"  value="'.$row['image3'].'" />
</td>
</tr>
<tr>
<td>

</tr>
</tr>
<tr>
<td>
<input type="submit" name="submitted" value="Submit" style="background:#ff0 none;" />
<input type="hidden" name="submitted" value="TRUE" />
</td>
</tr>
</table>
</form>'
;   

?>

[djjjozsi]

Change this:

$result = @mysql_query ($query); // Run the query. 

into:

$result = mysql_query ($query) or die(mysql_error()); // Run the query. 

And in your query there are undefined variables!

	         $query = "INSERT INTO blogb (blog_id, date1, date2, heading, category_id, first_para, entry, more, image1, image2, image3, image4, pub2 ) 
			   	  	   	   	     VALUES ('$blog_id', '$date1', '$date2', '$heading', '$category_id', '$first_para', '$entry', '$more', '$image1', '$image2', '$image3', '$image4', '$pub2')";

Print your query before run it, and test in phpmyadmin.

[bradgrafelman]

As djjjozsi suggests, you need to remove the '@' error suppressor from the query call (which should never be there in the first place, anyway - neither in a development or a production environment) to at least allow PHP to output error messages, if any. A common method of debugging SQL queries is adding the 'or die()' bit as djjjozsi illustrated (but don't forget to remove this when you've finished debugging!).

Also, to elaborate on djjjozsi's point, $blog_id, $date1, etc. are undefined variables. Where did you ever set these? If you can't answer that, then your script probably relied on register_globals - a directive which has been deprecated long ago due to the security risks it poses. For more information on the security aspect, see this manual page: [man]security.globals[/man].

Also, assuming you properly define the variables in the SQL query, it looks like your script is vulnerable to SQL injection attacks (again, assuming that the variables in question contain user-supplied data). User-supplied data should never be placed directly into a SQL query string. Instead, you must first sanitize it with a function such as [man]mysql_real_escape_string/man.