Data not going into mysql

[Hammad100]

Hi

I m unable to insert data into db in mysql.Here is the html code

<form id="geoform" role="form" action="insert.php" method="post">
<input name="show-confirmation" value="true" type="hidden">
<div class="large-7 columns">
<input autocomplete="off" name="address" id="geocomplete" placeholder="Enter Your Street Address" class="black-ph" type="text">
</div>
<div class="large-2 columns">
<input name="unit" id="unit" placeholder="Unit #" type="text">
</div>

                         <div class="large-3 columns">
                             <button type="submit" id="b1" class="button prefix"><span class="butlabel">Check Value!</span><span class="spinner"></span></button>
                         </div>

Here is the php code

<?php
//Establishing Connection with Server
$connection = @mysql_connect("localhost", "root", "");

//Selecting Database from Server
$db = @mysql_select_db("property-calculator", $connection);
if(isset($_POST['submit'])){

//Fetching variables of the form which travels in URL

$address = $_POST['address'];
$unit = $_POST['unit'];

if($address !=''||$unit !=''){
//Insert Query of SQL
$query = @mysql_query("insert into property(add1,un) values ('$address', '$unit')");
echo "<br/><br/><span>Data Inserted successfully...!!</span>";
}
else{
echo "<p>Insertion Failed <br/> Some Fields are Blank....!!</p>";   
}


}
//Closing Connection with Server
mysql_close($connection);

?>

Please help me

[Weedpacket]

The zeroth problem is that you haven't used any of the post formatting tags this forum provides for formatting your post.
The first problem is [thread=10387467]you're using the MySQL extension[/thread].
The second problem is you're using the error control operator to ignore errors from those MySQL functions and just assuming that they worked.
The third problem is, because you're assuming those function calls worked, you've done nothing to handle the possibility that they didn't work - in particular you haven't used the [man]mysql_error[/man] function to get any information about what is going wrong. Having this information wouldn't hurt you in your quest to fix your program.
The fourth problem is that you're doing nothing to prevent someone trashing your entire database by posting malicious data (which is easier with current MySQL extensions but is still doable in the obsolete one you're using).

[1andyw]

Weedpacket;11056159 wrote:

trashing your entire database by posting malicious data (which is easier with current MySQL extensions but is still doable in the obsolete one you're using).

Will you elaborate on that, please.
Andy

[Weedpacket]

1andyw;11056165 wrote:

Will you elaborate on that, please.
Andy

Look up "SQL injection" (start at http://php.net/manual/security.database.sql-injection.php). The current MySQL extensions make it easier to defend against such attacks; the obsolete MySQL provided some defence but even that it was broken until PHP 4.3.0.

[dalecosp]

1andyw;11056165 wrote:

Will you elaborate on that, please.
Andy

Weedpacket wrote:

(which is easier with current MySQL extensions but is still doable in the obsolete one you're using).

I think what Andy's saying is that this sentence makes it sound as if security went "backwards" with MySQL. That's not the typical way of thinking about it, although WP may well know something that we don't....

Probably just a little strange word order (and it's so easy to type strange things when we answer the same sorts of questions over, and over, and over ...)

[1andyw]

Thanks, everyone. 🙂

Andy