[Help] DB issues from PHP code.

Ben_Sherman

Dear phpbuilder members,

I would like to thank everyone for this fantastic website as my first entry here.
I've got some huge problems with my PHP codes, I've been working on a website for a while now and I got everything to work out on my test host but when I uploaded everything to real host it doesn't work correctly. It doesn't insert the query in to the database some how. The weard thing is that it works perfectly on my test host and not the real one.

<?php
session_start();
include('include/config.php');
$adding = $_GET['adding'];
$ID = $_GET['id'];
?> 

<!DOCTYPE html>
<html lang="en" >
<head>
<title>Everest Community</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<link rel="shortcut icon" href="favicon.ico" />
<style>
body {
background: #000000;
}
#top {
position: absolute;
z-index: -1;
margin-top: -8px;
margin-left: -8px;
background: url(http://everest-community.net/servers/images/layout.jpg) no-repeat;
width: 500px;
height: 119px;
}
#footer {
position: absolute;
z-index: 90%;
bottom: 0;
margin-top: -8px;
margin-left: -8px;
background: url(http://everest-community.net/servers/images/footer.jpg) no-repeat;
width: 500px;
height: 28px;
}
</style>
</head>
<body>
<section id="top"></section>
<br>

<center>
<form id="add_form" name="add_form" method="post" action="friend.php?adding=1&id=<?php echo "" .$ID . ""; ?>">
<input type="text" name="username2" id="username2"/> <br>
<font color="white">Please enter the username of your friend.</font>
<input type="image" src="http://********tyicons.com/free-icons/103/office/png/256/add2_256.png" width="20" height="20" value="submit" alt="submit"/> </form>  

</center>

<?php if($adding == "1") {
$username2 = mysql_real_escape_string($_POST['username2']);

$query = mysql_query("INSERT INTO contact (User, Friend) VALUES('$ID', '$username2')");
echo "<center><font color='green'>" .$username2 ." have been added in friend list!</font></center><br>";
}
?>

<section id="footer"></section>
</body>
</html>

I just got to say that I'm quite new to PHP well not that quite new, but I'm not really in to the advance functions and such, so I use HTML & PHP mixed.

Any one that can help me out where why the adding part doesn't work?

-Regards,
Ben Sherman

bradgrafelman

First problem I see is that you're using the [man]mysql[/man] extension. This entire extension has been outdated and deprecated for some time now; you should instead be using something like [man]MySQLi[/man] or [man]PDO[/man]. See [man]mysqlinfo.api.choosing[/man] for more info.

Second problem... you're using unsanitized user-supplied data in your SQL query. Doing this leaves you vulnerable to SQL injection attacks and/or just plain SQL errors. See [man]security.database.sql-injection[/man] for more info.

Third problem... you aren't even attempting to do any error handling in your code. For example:

Where do you attempt to connect to the DBMS? Do you ever check to see if you were successful? What happens if you weren't?
Where do you attempt to connect to select a database? Do you ever check to see if you were successful? What happens if you weren't?
You attempt to execute a SQL query, but do you ever check to see if you were successful? What happens if you weren't?

Finally, you're attempting to reference external variables (e.g. anything in $GET or $POST) without first checking to see if they exist (e.g. via [man]isset/man).