[RESOLVED] Help with DB input - part 2

AHoward007

The file below is now working well. Next I replaced the VALUES text input with $_POST entries as in the script line right below. Now I'm coming up with another error.

VALUES ($POST[english],$POST[monolingua],$_POST[comment])

<?php
mysql_connect("localhost","root","") or die('Could not connect: ' . mysql_error());
mysql_select_db("monoling_dictionary") or die('Could not connect: ' . mysql_error());

/ This section inserts values into english, monolingua and comment text fields in the monoling_dictionary database. /

mysql_query("INSERT INTO dictionary (english,monolingua,comment)
VALUES ('two','DVA','Two in Russian.')") or die('Could not connect: ' . mysql_error());
?>

Revised program:

<?php
mysql_connect("localhost","root","") or die('Could not connect: ' . mysql_error());
mysql_select_db("monoling_dictionary") or die('Could not connect: ' . mysql_error());

/ This section inserts values into english, monolingua and comment text fields in the monoling_dictionary database. /

mysql_query("INSERT INTO dictionary (english,monolingua,comment)
VALUES ($POST[english],$POST[monolingua],$_POST[comment])") or die('Could not connect: ' . mysql_error());
?>

dagon

need to quote the string values in the insert

AHoward007

I changed the line to this:

VALUES ($POST['english'],$POST['monolingua'],$_POST['comment'])") or die('Could not connect: ' . mysql_error());

It didn't work. I also tried double quotes.

dagon

VALUES ('$POST[english]','$POST[monolingua]','$_POST[comment]')")

AHoward007

I changed the quotes it didn't work.

I'm also going to change the input names englishinput, monolinguainput and commentinput to avoid confusion with the database column names which were the same. The file now reads:

<?php
mysql_connect("localhost","root","") or die('Could not connect: ' . mysql_error());
mysql_select_db("monoling_dictionary") or die('Could not connect: ' . mysql_error());

/* This section inserts values into english, monolingua and comment text fields in the monoling_dictionary database. */

mysql_query("INSERT INTO dictionary (english,monolingua,comment)

VALUES ('$_POST[englishinput]','$_POST[monolinguainput]','$_POST[commentinput]')") or die('Could not connect: ' . mysql_error());

//VALUES ('$_POST[english]','$_POST[monolingua]','$_POST[comment]')") or die('Could not connect: ' . mysql_error());

?>

bradgrafelman

The syntax seems fine; are you getting an error message?

Also note that your code is vulnerable to SQL injection attacks. User-supplied data should never be placed directly into a SQL query string; instead, it must be sanitized with a function such as [man]mysql_real_escape_string/man.

Also, when posting PHP code, please use the board's [noparse]

[/noparse] bbcode tags as they make your code much easier to read and analyze.

AHoward007

I didn't get any error messages. I then wrote another php file below trying to accomplish the same task but written in a different way. Again no error msg but file didn't execute properly. I'm wondering if the original Forms file written in html has a problem.

<?php
//Connect to database.
$con=mysql_connect("localhost","root","");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db("monoling_dictionary", $con);

//Retrieve posted info.
$englishinput=$_POST['englishinput'];
$monolinguainput=$_POST['monolinguainput'];
$commentinput=$_POST['commentinput'];

//Insert into database.
$sql="INSERT INTO dictionary SET english='$englishinput', monolingua='$monolinguainput', 
comment='$commentinput'";

//Display message.
if (!mysql_query($sql,$con))
{
die('Error: ' . mysql_error());
}
echo "Info successfully added!";

mysql_close($con)
?>

AHoward007

Found the problem. It was a misplaced closing </form> tag in my html file. Not with these php files.

Thanks!!!