can't update values in mysql using html and php

Question

I am trying to make a form using html and php to update mysql database. the database updates (autoincrements) the keys, but it does not add any of the strings to the values. i have searched people with similar problems but because their codes are different than mine I cannot understand it (i am a noob with php and mysql) I think my problem is in the way that i use the html to get the values but I could be wrong

<form action=submitform.php method=GET> 
     Name:<input type="text" name="cuName" size=20 maxlength=20><br>    
     Password:<input type="password" name="password" size=20 maxlength=45><br>
     Account:<input type="text" name="account" size=20 maxlength=45><br>
     Phone:<input type="tel" name="phone" size=10 maxlength=10><br>
     Email:<input type="text" name="email" size=20 maxlength=45><br>
<input type=submit>
</form>

and my php is

<?php
        mysql_connect(localhost,  myUsername, "myPassword");
        mysql_select_db(myDatabaseName);
        mysql_query("INSERT INTO Customer (cuName, password, 
                        account, phone, email)
                    Values('$cuName', '$password', '$account',
                            '$phone', '$email')");
        echo $cuName ." thank you for reserving!";
        print ($cuName);
    ?>

thanks in advance for any help

Burhan Khalid · Accepted Answer · 2012-08-07 23:02:05Z

Your code is relying on REGISTER_GLOBALS to be turned on; it is usually turned off for security reasons.

You should replace $cuName with $_GET['cuName'] to get the values that are sent from the form.

Additionally, you should escape any value that is going to the database otherwise you may be exposing yourself to an SQL injection vulnerability.

Cleaning up your code for both these scenarios, results in something like this:

<?php
        if (!mysql_connect(localhost,  myUsername, "myPassword")) {
              print 'There was an error connecting to the database'.mysql_error();
              exit(); 
        }
        if (!mysql_select_db(myDatabaseName)) { 
              print 'Could not select db. The error was: '.mysql_error();
              exit();
        }
        $query = "INSERT INTO Customer (`cuName`, `password`, `account`,`phone`,`email`)";
        $query .= "VALUES (";
        $query .= "'".mysql_real_escape_string($_GET['cuName'])."','";
        $query .= mysql_real_escape_string($_GET['password'])."','";
        $query .= mysql_real_escape_string($_GET['phone'])."','";
        $query .= mysql_real_escape_string($_GET['email'])."'";

        if (!mysql_query($query)) {
            print 'There was an error inserting '.$query.'. Error was '.mysql_error();
        } else {
            echo $_GET['cuName']." thank you for reserving!";
        }
        print $_GET['cuName'];
    ?>

I also added some error checking. You should always check results of functions that rely on external systems (such as databases) because you never know what is the status of the database (it could be down, not working, etc.) So you should always check and print any error messages.

Zack Tanner · Accepted Answer · 2012-08-07 23:02:18Z

0

You don't define any of your GET values anywhere. $cuName, etc are not defined.

Each value needs to be associated to the $_GET. IE,

$cuName = $_GET['cuName']

But you also need to make sure you don't insert data that hasn't been cleaned to prevent SQL injection. An example of this is:

$cuName = mysql_real_escape_string($_GET['cuName']);

So, try this:

<?php
        mysql_connect(localhost,  myUsername, "myPassword");
        mysql_select_db(myDatabaseName);

        //Define Variables
        $cuName = mysql_real_escape_string($_GET['cuName']);
        $password = mysql_real_escape_string($_GET['password']);
        $account = mysql_real_escape_string($_GET['account']);
        $phone = mysql_real_escape_string($_GET['phone']);
        $email = mysql_real_escape_string($_GET['email']);

        mysql_query("INSERT INTO Customer (cuName, password, 
                        account, phone, email)
                    Values('$cuName', '$password', '$account',
                            '$phone', '$email')") or die (mysql_error());
        echo $cuName ." thank you for reserving!";
        print ($cuName);
    ?>

edited Aug 7, 2012 at 23:02

answered Aug 7, 2012 at 22:56

Zack Tanner

2,5801 gold badge29 silver badges45 bronze badges

4 Comments

gcochard Over a year ago

Don't forget the obligatory use mysqli_* comment.

aldito2 Over a year ago

I just tried what you told me, but for some reason my database is getting the update but no names, passwords, etc. it just increments my autoincrement key.

aldito2 Over a year ago

i did, but I', getting the same results. my database grows with empty rows.

aldito2 Over a year ago

Sorry!!!! It seems I forgot to upload the code to my server but now it works flawlessly! THANK YOU!

GautamD31 · Accepted Answer · 2012-08-20 09:14:03Z

0

Better to use:

$cuname = $_GET['cuname'];

like this.... Because your form method is on "GET",and my advise is to POST data than GET.

answered Aug 20, 2012 at 9:14

GautamD31

28.8k10 gold badges66 silver badges86 bronze badges

Collectives™ on Stack Overflow

can't update values in mysql using html and php

3 Answers 3

Comments

4 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related