PHP Database: value not inserting in table

Question

insert.php

<?php
mysql_connect("localhost","root",""); mysql_select_db("basic");
$name=$_POST['fname'];
$twait=$_POST['twait'];
$cprice=$_POST['cprice'];
$dprice=$_POST['dprice'];
$order= "INSERT INTO calculator
        (name,total_wt,crt_price,dollar_rate) VALUES
        ('$name','$twait','$cprice','$dprice')";

$result = mysql_query('$order');
echo "Done";
?>

HTML page:

<!DOCTYPE html>
<html>
<head>
<title>JN DIAMONDS</title>
</head>
<body>
<form align="center" method="POST" action="insert.php">
    <fieldset>
        <legend>Info</legend><br>
        <input type="text" name="fname" placeholder="Name"><br><br>
        <input type="text" name="twait" placeholder="Total Rough Weight"><br><br>
        <input type="text" name="cprice" placeholder="1 Carat Price"><br><br>
        <input type="text" name="dprice" placeholder="Dollar Rate"><br><br>
        <input type="submit" name="submit"value="Submit"><br>
    </fieldset>
</form>
</body>
</html>

Hi John and welcome to SO (StackOverflow). I see you have just joined us. We strive to be a wonderful community and provide people with solutions to their coding problems as best we can. There are some basic fundamentals to asking a good question and consequently getting more experienced users to help you. In addition, most of us would like to see that you have put some effort into solving your problem. Show us what you've tried and what the results were. Again, welcome to SO! — Kuya
– Kuya, Commented Oct 14, 2015 at 6:55
Remove quotes form $result = mysql_query($order); And stop using mysql it is deprecated instead use mysqli or PDO — Saty
– Saty, Commented Oct 14, 2015 at 6:59
If you are not going to use mysqli or PDO with bound parameters, which is a bad idea not to, at least don't directly put variable unsanitized into the sql — Rasclatt
– Rasclatt, Commented Oct 14, 2015 at 7:03
Do yourself a favor - stop using mysql_. mysql_ has been deprecated since PHP 5.5 and removed in PHP 7. Using mysql_ leaves you wide open to sql injection attacks. Soon your code will stop functioning completely and you'll be back asking a question like this. Start learning pdo_mysql. When your host upgrades to PHP 7, you will be so happy you did. — Kuya
– Kuya, Commented Oct 14, 2015 at 7:04

Gravy · Accepted Answer · 2015-10-14 07:02:48Z

3

$order is a variable containing your mysql string. When you put $order in quotes, then you are not sending $order into the mysql string, you are actually trying to execute the query '$order' which is not a valid mysql query.

Simply remove the quotes.

$result = mysql_query($order);

answered Oct 14, 2015 at 7:02

Gravy

12.5k26 gold badges129 silver badges194 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Gravy Over a year ago

No problem. Please however take note of various comments suggesting that you move away from using mysql directly and using pdo. Mysql extension is deprecated. I recommend you also take a look at @VolkerK answer.

VolkerK · Accepted Answer · 2015-10-14 07:04:16Z

The actual error in your code has already been pointed out.
The mysql_* extension is deprecated and will be removed in the upcoming version 7 of php; choose another api to connect to your MySQL server, e.g. PDO. Using prepared statements will take care of the worst sql injections as well.

<?php
if ( !isset($_POST['fname'], $_POST['twait'], $_POST['cprice'], $_POST['dprice']) ) {
    trigger_error('missing POST parameter in '.var_export($_POST, true), E_USER_WARNING);
    echo '<html><head><title>...</title><body><h1>missing POST parameter</h1></body></html>';
}
else {
    $pdo = new PDO('mysql:host=localhost;dbname=basic;charset=utf8', 'root', '', array(
        PDO::ATTR_EMULATE_PREPARES=>false,
        PDO::MYSQL_ATTR_DIRECT_QUERY=>false,
        PDO::ATTR_ERRMODE=>PDO::ERRMODE_EXCEPTION
    ));
    $stmt = $pdo->prepare('
        INSERT INTO
            calculator
            (name,total_wt,crt_price,dollar_rate)
        VALUES
            (:fname,:twait,:cprice,:dprice)
    ');
    $stmt->execute(array(
        'fname'=>$_POST['fname'],
        'twait'=>$_POST['twait'],
        'cprice'=>$_POST['cprice'],
        'dprice'=>$_POST['dprice']
    ));
    echo "Done";
}

Abhishek Sharma · Accepted Answer · 2015-10-14 07:03:15Z

0

Pls try this code

<?php
    mysql_connect("localhost","root",""); mysql_select_db("basic");
    $name=$_POST['fname']; 
    $twait=$_POST['twait'];
    $cprice=$_POST['cprice']; 
    $dprice=$_POST['dprice'];
    $order= "INSERT INTO calculator
            (name,total_wt,crt_price,dollar_rate) VALUES
            ('$name','$twait','$cprice','$dprice')";
    $result = mysql_query($order);
    echo "Done";
    ?>

answered Oct 14, 2015 at 7:03

Abhishek Sharma

6,6241 gold badge17 silver badges20 bronze badges

Comments

Maha Dev · Accepted Answer · 2015-10-14 07:08:22Z

0

Use mysqli instead of mysql.

$con = mysqli_connect('localhost', 'root', '', 'basic');
$name=$_POST['fname'];
$twait=$_POST['twait'];
$cprice=$_POST['cprice'];
$dprice=$_POST['dprice'];
$order= "INSERT INTO `calculator` (name,total_wt,crt_price,dollar_rate) 
VALUES ('".$name."','".$twait."','".$cprice."','".$dprice."')";

$result = mysqli_query($con,$order);
echo "Done";

edited Oct 14, 2015 at 7:08

answered Oct 14, 2015 at 7:03

Maha Dev

3,9653 gold badges34 silver badges53 bronze badges

3 Comments

Gravy Over a year ago

Solving an unrelated problem. Also, bug still in your code. Thumbs down.

Gravy Over a year ago

You fixed it yourself. $result = mysqli_query($order); was $result = mysqli_query('$order');

Mihai Over a year ago

Using mysqli just to ignore pepared statements is not an improvement

Collectives™ on Stack Overflow

PHP Database: value not inserting in table

4 Answers 4

1 Comment

Comments

Comments

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

1 Comment

Comments

Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related