PHP/MySQL insert form

Question

As soon as you enter the web page it enters into the SQL table, even if you do not submit, immediately after you enter the web page it sends a blank to the SQL table, here is the codes both the HTML form and the PHP form.

<form name="" method="POST" action="">
<input class="" type="text" name="a1" id="a1" class="placeholder" placeholder="Enter the FRATERNITY Name">
<input class="" type="text" name="a2" id="a2" class="placeholder" placeholder="Enter YOUR Name">
<style>

<?php

$host="";
$username="";
$password="";
$database_name="";
$table_name="";

mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$database_name")or die("cannot select DB");

$a1=$_POST['a1'];
$a2=$_POST['a2'];

$sql="INSERT INTO $table_name(groupname, founder)VALUES('$a1', '$a2')";
$result=mysql_query($sql);

if($result){
echo "Group $a1 Has Been Created";

}

else {
echo "ERROR";
}
?> 

<?php 
// close connection 
mysql_close();
?>

You have a SQL injection vulnerability here.

halfer
– halfer

2015-06-07 12:11:25 +00:00
Commented Jun 7, 2015 at 12:11 — halfer
– halfer, Commented Jun 7, 2015 at 12:11

halfer · Accepted Answer · 2015-06-07 12:41:45Z

2

You need to check it if it's a post request, and then only execute your code. See below:

if($_SERVER['REQUEST_METHOD'] == "POST"){
    $host="";
    $username="";
    $password="";
    $database_name="";
    $table_name="";

    mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
    mysql_select_db("$database_name")or die("cannot select DB");

    $a1=mysql_real_escape_string($_POST['a1']);
    $a2=mysql_real_escape_string($_POST['a2']);

    $sql="INSERT INTO $table_name(groupname, founder)VALUES('$a1', '$a2')";
    $result=mysql_query($sql);

    if($result){
    echo "Group $a1 Has Been Created";

    }

    else {
    echo "ERROR";
    }
    ?> 

    <?php 
    // close connection 
    mysql_close();
}

Note that your code as it stands is vulnerable to a SQL injection attack. I've untainted the two input strings to protect against this.

edited Jun 7, 2015 at 12:41

halfer

20.2k20 gold badges111 silver badges208 bronze badges

answered Jun 7, 2015 at 9:23

kamal pal

4,1975 gold badges27 silver badges40 bronze badges

Sign up to request clarification or add additional context in comments.

10 Comments

viewers.gq Over a year ago

Thanks for the explanation! Makes a lot of sense, I really do appreciate your answer!

kamal pal Over a year ago

Welcome, and note: mysql_* functions are depreciated and will be removed in future, so use PDO instead

viewers.gq Over a year ago

i understand exactly what you pointed out to me and added, yet it is still only refreshing when submitted nothing happens. ALTHOUGH, it is not sending blanks into the database any longer.

kamal pal Over a year ago

after if you refresh, browser will prompt you that you are again sending the post request, to prevent this, you can redirect to the same page, at the end like header('location:thesamepage.php');

kamal pal Over a year ago

@halfer Mine was just example, how to get it done, however Agree to you, that it should be in practice :), updated answer respectively!

|

Collectives™ on Stack Overflow

PHP/MySQL insert form

1 Answer 1

10 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

10 Comments

Your Answer

Sign up or log in

Post as a guest

Related