Trying to Post to SQL

kidsil

Traditional form:
<HTML>
<HEAD>
<TITLE> First Form made from scratch [email listing] </TITLE>
</HEAD>
<BODY>
<form action="insert.php" method="get">
Name:
<input type="text" name="name" />
E-mail
<input type="text" name="email" />
<input type="Submit" value="Submit">
</form>
</BODY>
</HTML>

Pretty simple PHP:

$con = mysql_connect(working);
if (!$con)
{
die('could not connect' .mysql_error());
}
mysql_select_db("phptest".$con);
$name = $GET["name"];
$email = $GET["email"];
mysql_query("INSERT INTO Persons (Name,Email) VALUES ($name,$email)");

$result = mysql_query("SELECT * FROM Persons");

while ($row = mysql_fetch_array($result))
{
echo $row['Name']." ". $row['Email'];
echo "<br />";

}

mysql_close($con);
?>

and yet, an error on send:

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in insert.php on line 15

help?

dagon

your mysql_select_db() is wrong, full stop instead of a comma

kidsil

thanks a lot, it doesn't do the error anymore but for some reason it doesn't insert the name to the database...
I checked the structure and it is all good, the names are all ok.. what gives?

NogDog

Your values need to be quoted within the VALUEs() expression of the query. (A good practice is to check if the return value of mysql_query() is false, and if so, log an error including the SQL string that was used plus the result of mysql_error() in order to find out what went wrong.) Also, any user-supplied values used in a query should be "sanitized" via mysql_real_escape_string() in order to avoid SQL injection issues.

PS: I'd suggest using method="post" in the form and $POST instead of $GET in the PHP, since the form makes DB changes, so you don't want the URL to be bookmarked and then try to make the same change every time the user accesses it.