Help: adding information to MYSQL database using PHP form

jnalli121

Im fairly new to webdesign and this is my first ever project. Im trying to add some information into a database using a form. this is what i have so far:

form:

<html>
<body>

<form action="insert.php" method="post">
Name: <input type="text" name="name" />
<br>
Phone number: <input type="text" name="phonenumber" />
<br>
Work address: <input type="text" name="workaddress" />
<br>
Email: <input type="text" name="email" />
<br>
Education and Work Experience: <input type="text" name="education" />
<br>
Job description: <input type="text" name="jobdesc" />
<br>
Keywords to describe your career(separate with commas): <input type="text" name="keywords" />
<br>
<input type="submit" />
</form>

</body>
</html>

insert.php:

<?php
$con = mysql_connect("host","user","pass");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("b2_5151180_searchengine", $con);

$sql="INSERT INTO mentors (Name, Phone number, Work address, Email, Education and Work Experience, Job description, Keywords)
VALUES
('$_POST[name]',$_POST[phonenumber],'$_POST[workaddress]','$_POST[email]','$_POST[education]','$_POST[jobdesc]','$_POST[keywords]')";

if (!mysql_query($sql,$con))
  {
  die('Error: ' . mysql_error());
  }
echo "Thank you. Your name has been added to our database.";

mysql_close($con)
?>

but my problem is that each time i enter the information into the form and click submit i get an error saying "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'number, Work address, Email, Education and Work Experience, Job description, Key' at line 1".

Any help would be greatly appreciated.

thanks!

bradgrafelman

Hi, and welcome to PHPBuilder! Note that I'v edited your post and switched out the CODE tags for HTML and PHP tags - the syntax highlighting often makes code easier to read and analyze.

Your first problem is that you have column names with spaces in them. If you use spaces, you must enclose the name in backticks (`) so that MySQL knows that you're specifying one single column. It is for this reason that you hardly ever see column names with spaces in them - use CamelCase or underscores instead.

Second, user-supplied data should never be placed directly into a SQL query. Instead, it must first be sanitized with a function such as [man]mysql_real_escape_string/man for string data and something akin to [man]intval[/man] for integers (and similarly for other numeric types).

jnalli121

thanks a lot for the help! I edited the code by inserting backticks and it works!

as per the mysql_real_escape_string()
what exactly does this do?

bradgrafelman

jnalli121 wrote:
what exactly does this do?

See the manual page for the function - it gives a thorough description as well as coding examples.

In addition, if you've never even heard of the function or SQL injections, you might want to read an article or two on the subject (the PHP manual also has a page for it: [man]security.database.sql-injection[/man]) before you do any more developing with SQL.