bradgrafelman;10987461 wrote:Here are some more issues with the PHP code:
You might want to obfuscate your login credentials before posting them on a public forum .
For things like DB credentials, I prefer to use [man]constants[/man] over variables. After all, your credentials probably aren't going to vary during the execution of the script but instead remain constant.
Plus, this would remove confusion around variables named like $password which you later overwrite with user-supplied data (meaning your DB credentials have been lost before you ever call mysql_connect() above).
Assignments like this:
$fname=$_POST['Value1'];
will cause E_NOTICE level errors if the external data wasn't passed to the script. Instead, I prefer to write such assignment statements like so:
$fname = isset($_POST['Value1']) ? $_POST['Value1'] : NULL;
That way you can define some default value to the variable $fname if the external 'Value1' value wasn't provided (all while eliminating the possibility of generating any error messages).
Speaking of $_POST['Value1'], where did all of those ValueXX names come from? None of your form elements are named like that, so your PHP script will never access any of the data submitted (and instead just generate a bunch of E_NOTICE level errors about an 'undefined index' being used).
This:
mysql_connect(localhost,$cpmsripple,$D*amond2);
line has a few problems:
Where do you define the constant localhost? I'm guessing the answer is that you haven't and that you instead meant to use the string "localhost" there. As such, you're missing quotes (since all strings must be delimited in some way, most often by quotes on either side).
Where do you define the variable $cpmsripple? I'm guessing the answer is that you haven't and that you instead meant to use the variable named $database.
The third parameter says this: "Take the variable $D and multiply it by the constant named amond2." Perhaps you meant to use the variable named $password instead?
You should be checking to see if [man]mysql_connect/man succeeded or not and, if not, take whatever action is appropriate.
Couple of problems with this:
@mysql_select_db($cpmsripple) or die( "Unable to select database");
Don't use the '@' error suppressor. Ever. It does nothing but hinder development by hiding error messages that otherwise could have helped the developer (i.e. you) fix the underlying problems that caused them. Don't use it. Ever.
Where do you define the variable $cpmsripple? I'm guessing the answer is that you haven't and that you instead meant to use the variable named $database.
Finally, some issues with the SQL query itself:
Always include column names in INSERT queries (e.g. "INSERT INTO myTable (col1, col2) VALUES ...") to remove ambiguity. Otherwise, you have to go lookup the table schema in the DB (which could change!) to understand how the query works.
After you do that, you can simply omit the first column altogether from the query (which I'm guessing is an AUTO_INCREMENT column?).
User-supplied data should never be placed directly into a SQL query, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors. Instead, you must first sanitize the data with a function such as [man]mysql_real_escape_string/man (for string data).
Always check to see if [man]mysql_query/man indicates that the query was executed successfully. If not, you should output or log (depending whether you're in the development or production environments, respectively) helpful debugging information such as the query string that was executed as well as the error message returned by MySQL (see [man]mysql_error/man).
Hi,
I have just joined this forum yesterday but when I looked at this post the problem i saw was the very basic one even though I did not copy and tried to run the code the problem is here
$query = "INSERT INTO cprofile VALUES
('','$fname','$lname','$email','$gender','$birth','$age','$password','$phone1','$mobile','$fax','$description');
My friend you have missed thedouble quotes in the query as well.
it must be
$query = "INSERT INTO cprofile VALUES
('','$fname','$lname','$email','$gender','$birth','$age','$password','$phone1','$mobile','$fax','$description')";
and always try to replace the variable values with '".$name."' and so on.
Hope that it will help.
Regards
