simple INSERT problem

generic

Hi all,

I'm sure someone here will spot this immediately 🙂 I'm working on a (very) basic little script to add customers information to a database and being a visual designer moreso than a programmer, I can't see where I'm going wrong with this. It won't insert the info when I submit.

Any help would be appreciated, thanks!

gen

<?php
function createform() {
	echo '<form action="'. $_SERVER['REQUEST_URI'] .'" method="post">
				<p>Name:<br />
					<input type="text" name="name" id="name" />
				</p>
				<p>Email:<br />
					<input type="text" name="email" id="email" />
				</p>
				<p>Phone:<br />
					<input type="text" name="phone" id="phone" />
				</p>
				<p>Address:<br />
					<textarea name="address" id="address" cols="45" rows="5"></textarea>
				</p>
				<p>Comments: <br />
					<textarea name="comments" id="comments" cols="45" rows="5"></textarea>
				</p>
				<p>
					<input type="submit" name="submit" id="submit" value="Submit" />
					<input type="reset" name="reset" id="reset" value="Reset" />
				</p>
			</form>';
		}

$submit = $_GET['submit'];

if(isset($submit)) {

$name = $_GET['name'];
$email = $_GET['email'];
$phone = $_GET['phone'];
$address = $_GET['address'];
$comments = $_GET['comments'];

mysql_query("INSERT INTO customers (name, email, phone, address, details) VALUES('$name', '$email', '$phone', '$address', '$comments') ") or die(mysql_error());  

echo '<p class="success">Customer Added!</p>
		<ul>
			<li>Name: '. $name .'</li>
			<li>Email: '. $email .'</li>
			<li>Phone: '. $phone .'</li>
			<li>Address: '. $address .'</li>
			<li>Comments: '. $comments .'</li>
		</ul>';

} else {

createform();

}

?>

Weedpacket

The form uses POST but you're looking in $_GET.

generic

Thanks for the heads up! I just changed the form method to GET but it still won't insert...

Bjom

Change the form method back to POST and change your variables to read from the post array

like so
$_POST['name'] etc.

do a var_dump() on the $submit variable like so:

var_dump($submit);

and also on the query.

This enables you to see what's happening.

also: mysql is being phased out, why not use mysqli instead?

on an other note: you are asking for sql injection and XSS...

$SERVER['REQUEST_URI']...I would suggest $SERVER['SCRIPT_NAME']

generic

Tried making the changes but still no luck. I don't know if it makes a difference or not but this is an included file. I have "customers.php" that has a "new customer" link something like

customers.php?a=addnew

which loads the included file, as outlined above. When I click submit, it just dumps me back to customers.php without the included file.

But yea, no luck so far. Thanks for the replies so far though.

Bjom

I can't follow you there.

However: if the includes somehow get you confused: get rid of them until everything works, then sort it out back into the includes. Including a file is exactly the same as having the lines inside a file.

So myTest1.php and myTest2.php are equivalent:

file "myTest1.php"

<?php
echo 'something I always wanted to see on my page:';
include 'include.php';

echo 'fini';
?>

file "include.php"

<?php
echo 'If you run myTest1.php I come from an include. If you run myTest2.php I am straigtht in the file';
?>

file "myTest2.php"

<?php
echo 'something I always wanted to see on my page:';
echo 'If you run myTest1.php I come from an include. If you run myTest2.php I am straigtht in the file';

echo 'fini';
?>

generic

I see what you're saying, I do run it from the "customers.php" file if it doesn't work from the "new_customer.php" include just to be sure, but I still just can't seem to get it to insert into the database. It's the oddest thing.

Technically, this should be working, right? Does the code look right?

Thanks again for all the help so far!

function createform() {
	echo '<form action="'. $_SERVER['SCRIPT_NAME'] .'" method="POST">
				<p>Name:<br />
					<input type="text" name="name" id="name" />
				</p>
				<p>Email:<br />
					<input type="text" name="email" id="email" />
				</p>
				<p>Phone:<br />
					<input type="text" name="phone" id="phone" />
				</p>
				<p>Address:<br />
					<textarea name="address" id="address" cols="45" rows="5"></textarea>
				</p>
				<p>Comments: <br />
					<textarea name="comments" id="comments" cols="45" rows="5"></textarea>
				</p>
				<p>
					<input type="submit" name="submit" id="submit" value="Submit" />
					<input type="reset" name="reset" id="reset" value="Reset" />
				</p>
			</form>';
		}

$submit = $_POST['submit'];

if(isset($_POST['submit'])) { 

$name = $_POST['name'];
$email = $_POST['email'];
$phone = $_POST['phone'];
$address = $_POST['address'];
$comments = $_POST['comments'];

mysql_query("INSERT INTO customers (name, email, phone, address, details) VALUES('$name', '$email', '$phone', '$address', '$comments') ") or die(mysql_error());  

echo '<p class="success">Customer Added!</p>
		<ul>
			<li>Name: '. $name .'</li>
			<li>Email: '. $email .'</li>
			<li>Phone: '. $phone .'</li>
			<li>Address: '. $address .'</li>
			<li>Comments: '. $comments .'</li>
		</ul>';

} else {

createform();

}

Bjom

actually no it doesn't:

mysql_query needs to know which DB to write to, i.e. where to link to and thus needs a database connection as the second attribute.

Also: do yourself a big favor and add another step and variable like this:
And get rid of that "or die" ffs!
And switch to mysqli while you are at it.

$sql = "INSERT INTO customers (name, email, phone, address, details) VALUES('$name', '$email', '$phone', '$address', '$comments')";
// echo $sql; //always great to check first...
mysql_query($sql, $link) or trigger_error(mysql_error(), E_USER_ERROR);