My insert isn't working

SamJudi

It's giving me an error but not telling me why it's not working.

Any ideas would be appreciated. Here's my code:

            $conn = mysqli_connect($hostname, $username, $password) OR DIE 
			("Unable to connect to database! Please try again later.");



        $CustNameFirst = $_POST['CustNameFirst'];
    $CustNameLast = $_POST['CustNameLast'];
        $CustEmail = $_POST['CustEmail'];
        $Address1 = $_POST['Address1'];
    $Address1 = $_POST['Address2'];
    $City = $_POST['City'];
    $State = $_POST['State'];
    $ZipCode = $_POST['ZipCode'];
        $CustPhone = $_POST['CustPhone'];
        $Brand = $_POST['Brand'];
        $ProdName = $_POST['ProdName'];
    $Store = $_POST['Store'];
    $StoreAddress = $_POST['StoreAddress'];
    $Neighborhood = $_POST['Neighborhood'];
    $ProductFound = $_POST['ProductFound'];
        $Comments = $_POST['Comments'];


        mysqli_select_db($conn, $dbname);

		/*Insert data into tblCustomer*/
        mysqli_query($conn, "Insert into tblCustomer
	(CustNameFirst, CustNameLast, CustEmail, Address1, Address2, City, State, ZipCode, CustPhone, Brand, ProdName, Store, StoreAddress, Neighborhood, ProductFound, Comments) 
               Values ('$CustNameFirst', '$CustNameLast', '$CustEmail', '$Address1', '$Address2', '$City', '$State', '$ZipCode', '$CustPhone', '$Brand', '$ProdName', '$Store', '$StoreAddress',                  '$Neighborhood', '$ProductFound', '$Comments");

                   If(!$mysqli_query )
		   {
		   	 die ('Could not enter Customer data: '. mysql_error());
		   }

NogDog

There is no $mysqli_query variable for you to check in that final if(), so it's always going to fail. Try assigning the result of your mysql_query() call to a variable, then check that variable to see if it failed.

Also, you do not appear to escape any of the input variables used in that query, so you are wide open to SQL injection errors/attacks.

Oh, and if mysqli_query() fails, you won't get any useful information from mysql_error() (note the lack of an "i" in that function's name).

bradgrafelman

Welcome to PHPBuilder! When posting PHP code, please use the board's [noparse]

..

[/noparse] bbcode tags as they make your code much easier to read and analyze.

First and foremost, user-supplied data should never be placed directly into a SQL query, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors. See [man]security.database.sql-injection[/man] for more information.

Second, what output are you receiving? You've got two different 'die' statements but didn't tell us which one is being triggered. Also, assuming you're reaching the second one, try moving the SQL query into a variable so that you can output it (i.e. in order to show it to us in your next post 🙂) exactly as it was sent to the MySQL server.

EDIT: Apparently I'm both slower and less observant than NogDog. See his points above as well. :o

SamJudi

Thanks for the advice. I got it to work. And next time I promise to follow the rules.