Trying to create a form

[bjornih]

Hi, I'm pretty new to this, so these might be some silly questions, but hey, I'm here to learn =D

I'm currently trying to create a form, using html, php and MySQL, the only problem is that I keep getting the same error, which is as follows

Parse error: syntax error, unexpected T_STRING in /home/ecomaxi1/public_html/protected/tableget.php on line 14

my script is this:

<?php
$con = mysql_connect("host","user","password");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("database", $con);

$sql="INSERT INTO table (FirstName, LastName, Age)
VALUES
('$_POST[firstname]','$_POST[lastname]','$_POST[age]')"

mysql_query('$sql','$con')
  {
  die('Error: ' . mysql_error());
  }
echo "1 record added";

mysql_close($con)
?> 

what is my error, how can I fix it?

thank you =)

[bradgrafelman]

Few problems:

1. Your parse error is being caused by a missing semicolon (look at the statement just before the line # indicated in the parse error). Looking through the code, you've actually got a few missing semicolons.

2. This:

   mysql_query('$sql','$con') 
     { 
     die('Error: ' . mysql_error()); 
     } 

   makes no sense, since the die() statement will always be executed. Perhaps you meant to wrap that section of code in an if() statement instead?

3. Finally (and perhaps most importantly), user-supplied data should never be placed directly into a SQL query string, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors. Instead, you must first sanitize the data with a function such as [man]mysql_real_escape_string/man (for string data).

[bjornih]

Thank you, I got it working by cleaning up that code a lot. Can you please explain some more about the mysql_real_escape_string() where I'd place it in the code and how it works?

[recognize]

u will need to turn your $_post[] into vars.

so like idk

$firstname = mysql_real_escape_string($firstname);
$lastname = mysql_real_escape_string($lastname);

mysql_query("INSERT INTO example (firstname, lastname) VALUES($firstname, $lastname ) ") 
or die(mysql_error());

You're also gonna want to have if statments to check the values also.

so

if (!preg_match("#^[a-zA-Z]+$#", $firstname))
           {
        echo "u can only use letters in your name";
           }
        else{

add content to database with your insert query };
         

the preg_match up top is just saying. if anything entered into the input field is anything other than capital letters or lowercase letters then it will produce an error and not enter content into database. you must do this if its a user form. if u are using it behind a back admin. u should be okay. but its clean to do it anyway.

escape string is to check if whats entered in the field is sql attack.

people will tell u to use java script to check content of fields . dont do this. u need to do it server side because people can turn javascript off. u can do both. both javascript and php. but always do php.

im not good but i saw ur question and recognize the frustrations of a simple form.

[recognize]

$firstName=mysql_real_escape_string($_POST['firstname'];

rather