[RESOLVED] Input... because I can't even get this right

Edwin_Okli

<?php
	mysql_connect("localhost","root") or die(mysql_error());
	mysql_select_db("good") or die("Could not select the database.");	

	if(isset($_POST['submit'])){

		$name = $_POST['name'];
		$desc = $_POST['desc'];
		$cont = $_POST['cont'];

	$query = "INSERT INTO projects (name, desc, cont) VALUES ('$name', '$desc', '$cont')";
	$sql = mysql_query($query);
		if($sql){
			echo "<div id='error'>+ You have successfully submitted ".$name."!</div>";
		} elseif(!$sql) {
			echo "<div id='error'>- ".$name." could not be submitted!</div>";
		} elseif(!$name) {
			echo "<div id='error'>- You must include a title name!</div>";
		} elseif(!$desc) {
			echo "<div id='error'>- You must include a description!</div>";
		} elseif(!$cont) {
			echo "<div id='error'>- You must include content!</div>";
		} else {
			echo "<div id='error'>- We're not quite sure what happened there.</div>";
		}
}
?>

Ehh.. lots of if's. It seems I'm gonna use this forum lots..
Any help? Thanks.

halojoy

so what is problem?
what do you get?

it is important that you tell any errors
to give us some info to help

Edwin_Okli

Oh sorry.. it fails to insert a row into the table no matter what I try.

halojoy

What is the output?
does it echo something, some of your messages

Edwin_Okli

It outputs the second message.
"- ".$name." could not be submitted!"

halojoy

I would try 2 things. like this:

        $query = "INSERT INTO projects (name, desc, cont) VALUES ('$name', '$desc', '$cont')";
        echo 'Query: '.$query.'<br>'; // debug1
        $sql = mysql_query($query);
        if(!$sql) echo 'MySQL Error: '.mysql_error().'<br>'; // debug2

johanafm

Soem logical issues to fix.

if ($sql) ...
else if (!$sql) ...

While the last part isn't wrong, it's also superflous. Either the first is true or the second is. So just else is enough. The main problem here is not checking what went wrong.

if ($sql) {

}
else {
	echo/error_log( mysql_errno() . ': ' . mysql_error() );
}

The following else ifs will never be executed, since $sql can never be anything but true or false, which means that either the first or second if block is executed. Always.

And if you don't want to insert empty strings for name etc, check that BEFORE you actually insert anything.

Edwin_Okli

Upon testing, I received the following mysql error:
"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'desc, cont) VALUES ('test_title', 'test_desc', 'test_cont')' at line 1"

halojoy

Suppose one of these should be a NUMBER?
('$name', '$desc', '$cont')

If $cont is a number
we should use:
('$name', '$desc', $cont)

What type of fields are these in your table: (name, desc, cont) ???
TEXT, VARCHAR, INTEGER, INT .......?

johanafm

desc is a reserved word (order by fieldname DESC). List of MySQL's reserved words.

bradgrafelman

As such, you can either rename the column to avoid the use of a reserved word, or you can surround it with backticks so that MySQL knows you're using an identifier rather than a special/reserved word.

Also, note that user-supplied data should never be placed directly into a SQL query string. Instead, it must first be sanitized with a function such as [man]mysql_real_escape_string/man (or use a newer library of functions such as [man]MySQLi[/man] or [man]PDO[/man] to utilize prepared statements).