Please Help

bohra_sankalp

No Error but query is not firing.... Input is going to database.

<?php 
session_start();
$_SESSION["type"]="moderator";
$_SESSION["moderator"]="sankalp";
$_SESSION["code"]=rand(1000,9999);
if(!isset($_SESSION["type"]))
{
	header("Location:login.php");
}
else
{
	include("config.php");
	if(isset($_SESSION["moderator"]))
	{	
		if(isset($_POST["submit"]))
			{
				extract($_POST);
				if($code=='')
				{ 
					$error="Input Captcha";
				}
				//inputing on without filling captcha
				elseif($code== $_SESSION["code"])
					{	
					//$moderator=$_SESSION["moderator"];
					$sql= "INSERT into tbl_poet_info(poet_name,poet_info,poet_book) values('$name','$about','$books') ";
					mysql_query($sql);
					$error="done";
					//unset($_SESSION["code"]);
					}
				}
	}
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
</head>

<body>
<form action="<?=$_SERVER['PHP_SELF'];?>" method="post" name="form1" id="form1">
  <table width="410" border="0" align="center">
    <tr>
      <td width="80" valign="top">Name :</td>
      <td width="320"><input name="name" type="text" id="name" size="50" maxlength="50" /></td>
    </tr>
    <tr>
      <td valign="top">About :</td>
      <td><textarea name="about" id="about" cols="45" rows="5"></textarea></td>
    </tr>
    <tr>
      <td valign="top">Books :</td>
      <td><textarea name="books" id="books" cols="45" rows="5"></textarea></td>
    </tr>
    <tr>
      <td valign="top">Picture :</td>
      <td><input type="file" name="photo" id="photo" /></td>
    </tr>
    <tr>
      <td valign="top">Captcha :</td>
      <td><iframe src="captcha.php" width="75" height="25" scrolling="No" frameborder="0"></iframe> | <input name="code" type="text" id="code" size="4" maxlength="4" /><?=$msg?></td>
    </tr>
    <tr>
      <td><div align="right">
        <input type="submit" name="submit" id="submit" value="Submit" />
      </div></td>
      <td><input type="submit" name="reset" id="reset" value="Clear" /></td>
    </tr>
    <tr>
      <td colspan="2"><div align="center"><?=$error?></div></td>
    </tr>
  </table>
</form>
</body>
</html>

bradgrafelman

When posting PHP code, please use the board's [noparse]

..

[/noparse] bbcode tags as they make your code much easier to read and analyze.

Some comments:

Don't use [man]extract/man on $_POST - it opens up the same security vulnerabilities that register_globals does. In addition, it's harder to tell where a variable is coming from.

For example, is $code: a) defined in the same script somewhere else, b) defined in a different script, c) a container for user-supplied data, d) not defined at all (e.g. a typo/error), e) none of the above. By just looking at your code, it's hard (if not impossible) to tell which of these is true. If, however, you instead used something like $_POST['code'], your meaning is instantly clear.
User-supplied data should never be placed directly into a SQL query string, else your code will be vulnerable to SQL injection attacks. Instead, it must first be sanitized with a function such as [man]mysql_real_escape_string/man (for string data).
You never test to see if [man]mysql_query/man was successful or not (and thus do some error handling/debugging if not). It's pretty hard for us to diagnose an issue when you never do any debugging to find out if something is going wrong.
Don't use the '<?= (expression) ?>' short open tags - they are disabled by default (and for good reasons). Instead, always use the full '<?php' tag (and use echo/print to mimic the '<?=' shorthand syntax).