PHP to MySQL Issue

[AKSailor]

I am using a form generation site named "phpFormGenerator" to help build an on-line form the populates fields in an existing MySQL table. Ultimately, I want the MySQL table to populate an on-line table of info. [One logs on, enters his info, then that info appears in a table on the page. It's for sharing rides.]

The form seems to work, although it's generic and therefore quite complicated. I can logon, complete the on-line form, and submit. The form generates an email to me telling me that the form has been completed, but does not enter the data into MySQL table. I receive no error messages. There are separate pages for the form.html, processor.php, install.php, and confirm.html (allows one to click and return to the rideshare page). I will temporarily assume that the form.html is correct. Here's the much smaller processor.php.

The "config.inc.php" might also be a problem. There was no such page included in the file that was generated but some on-line comments at that site indicated that simply creating such a page and including it in the site might work, so that's what I did.

I think that the problem is that this script does not make the proper links between the fields that the user completes and the specific fields that I use in MySQL table. Remember that this script does generate an email that properly lists the data.

<?php

$where_form_is="http://".$_SERVER['SERVER_NAME'].strrev(strstr(strrev($_SERVER['PHP_SELF']),"/"));

include("config.inc.php");
 $link = mysql_connect("localhost","XXXXXXXX","XXXXXXXXXX");
if(!$link) die ('Could not connect to database: '.mysql_error());
mysql_select_db($db_name,$link);
$query = "INSERT into RideShareInfo (`Contact Name`,`Travel Date`,`Return Date`,`Contact Information`) VALUES ('" . $_POST['field_1'] . "','" . $_POST['field_2'] . "','" . $_POST['field_3'] . "','" . $_POST['field_4'] . "')";
mysql_query($query);
mysql_close($link);

mail("[e-mail]","phpFormGenerator - Form submission","Form data:

Contact Name: " . $_POST['field_1'] . " 
Travel Date: " . $_POST['field_2'] . " 
Return Date: " . $_POST['field_3'] . " 
Contact Information: " . $_POST['field_4'] . " 

");

include("confirm.html");

?>

I'm working through the php/html/MySQL issues as I come to them. Removing all my error responses was a major victory for me, and I think you for that ability.

[dagon]

replace

mysql_query($query); 

with

mysql_query($query) or die ('query fail: '.mysql_error());
echo $query;

try that, it will tell you if your query worked, and if not why, and output the actully query for debugging.

[bradgrafelman]

Also note that user-supplied data should never be placed directly into a SQL query string, otherwise you'll be vulnerable to SQL injection attacks (and/or just plain SQL errors). Instead, it must first be sanitized with a function such as [man]mysql_real_escape_string/man.