0

I am trying to insert som data from html forms into my mySql database server.

Here is my html-code: 

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
  <html xmlns="http://www.w3.org/1999/xhtml">
  <head>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
  <title>Add events</title>
</head>
<body>
<form action="addevents.php" method="post">
        id: <input type="text" name="eventID" />
        <br></br>
        larmkod: <input type="text" name="larmkod" />
        <br></br>
        idArduinoT: <input type="text" name="idArduinoT" />
        <br></br>
        handelse: <input type="text" name="handelse" />
        <br></br>
        tid: <input type="text" name="tid" />
        <br></br>
        rumNr: <input type="text" name="rumNr" />
        <br></br>
        inneboendeNamn: <input type="text" name="inneboendeNamn" />
        <br></br>
        overvakare: <input type="text" name="overvakare" />
        <input type="submit" />
</form>
</body>
</html>

Here is my php-code:

<?php
$con = mysql_connect("localhost","humhum","humhum");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("arduino_db",$con;

$sql="INSERT INTO events (eventID, larmkod, idArduinoT, handelse, tid, rumNr, inneboendeNamn, overvakare)
VALUES
('$_POST[eventID]', '$_POST[larmkod]', '$_POST[idArduinoT]', '$_POST[handelse]', '$_POST[tid]', '$_POST[rumNr]',
    '$_POST[inneboendeNamn]', '$_POST[overvakare]')";

if (!mysql_query($sql,$con))
  {
  die('Error: ' . mysql_error());
  }
echo "1 record added";

mysql_close($con)
?>

I don´t see the problem do you? .. eventID is the primary key.

Improve this question
5
  • 1
    Nope, I don't see the problem. You didn't tell us. Commented May 11, 2011 at 20:14
  • 2
    problem- your are open to sql injection attack, you must sanitise your data before putting it in the db Commented May 11, 2011 at 20:16
  • Yes I know, but I am only using it temp for out school project... Commented May 11, 2011 at 20:17
  • What error message do you get? Commented May 11, 2011 at 20:18
  • Whats the problem/error? Commented May 11, 2011 at 20:19

3 Answers 3

Reset to default
4

Let's see... Syntax errors:

mysql_select_db("arduino_db",$con;
                                 ^ missing )

SQL injection errors:

$sql="INSERT INTO events (eventID, larmkod, idArduinoT, handelse, tid, rumNr, inneboendeNamn, overvakare)
VALUES
('$_POST[eventID]', '$_POST[larmkod]', '$_POST[idArduinoT]', '$_POST[handelse]', '$_POST[tid]', '$_POST[rumNr]',
    '$_POST[inneboendeNamn]', '$_POST[overvakare]')";

If any of the form fields contain a ', your query statement will be invalid. As well, little Bobby Tables will have a field day with your system.

Improve this answer
Sign up to request clarification or add additional context in comments.

2 Comments

you to sir! have a field day with your system!
PHP should have spit out a syntax error for you if it was the missing ) causing your problem, which suggests that error reporting is off. That SHOULD be turned on while you're developing
1

Your query is wrong ;)

Try this:

$sql="INSERT INTO events (eventID, larmkod, idArduinoT, handelse, tid, rumNr, inneboendeNamn, overvakare)
VALUES
('{$_POST['eventID']}', '{$_POST['larmkod']}', '{$_POST['idArduinoT']}', '{$_POST['handelse']}', '{$_POST['tid']}', '{$_POST['rumNr']}',
    '{$_POST['inneboendeNamn']}', '{$_POST['overvakare']}')";

Look @ your escaping

And edit

mysql_select_db("arduino_db",$con;

Into

mysql_select_db("arduino_db",$con);

You need to work on your security btw. This is really insecure!

Improve this answer

5 Comments

The {} notion on the variables isn't necessary. It's good to use it, but it's not required. echo "{$array['x']}" is syntactically identically to echo "$array[x]" as far as PHP is concerned for 1-dimensional arrays.
hmm really i thought the $array[x] should be at least $array['x'] with the single quotes since its an associative array in this example
echo "$array[x]" is not syntactically identical. It attempts to dereference the constant x, and raises a notice error if x has not been defined. If you define('x', 'y'), then echo "$array[x]" ends up producing the same output as echo "$array['y']"
Inside double-quoted strings, array keys don't need to be quoted. It's a PHP quirk. But, if you use a 2+ dimensional array, then the {} notation is necessary. PHP's parser isn't greedy and will only snag the first dimension. echo "$array[1][2]" will be parsed as echo $array[1], "[2]", so you have to say echo "{$array[1][2]}".
@marc and that's exactly why it's good practice to use "{$array[1]}" even when it isn't strictly necessary. It makes it absolutely clear to others reading your code what you intended.
1 
$sql="INSERT INTO events (eventID, larmkod, idArduinoT, handelse, tid, rumNr, inneboendeNamn, overvakare)
VALUES
('$_POST[eventID]', '$_POST[larmkod]', '$_POST[idArduinoT]', '$_POST[handelse]', '$_POST[tid]', '$_POST[rumNr]',
    '$_POST[inneboendeNamn]', '$_POST[overvakare]')";

Each one of those references to POST is somewhat ambiguous, and raises a notice-level error due to the unquoted string. Less ambiguous syntax:

$sql="INSERT INTO events (eventID, larmkod, idArduinoT, handelse, tid, rumNr, inneboendeNamn, overvakare)
VALUES
('{$_POST['eventID']}', '{$_POST['larmkod']}', '{$_POST['idArduinoT']}', '{$_POST['handelse']}', '{$_POST['tid']}', '{$_POST['rumNr']}',
    '{$_POST['inneboendeNamn']}', '{$_POST['overvakare']}')";

However, this will still result in a SQL error, or even worse, SQL injection should any value contain a ' char (among others). These values should, at a minimum, be run through mysql_real_escape_string(). Alternately, used parameterized queries.

If there are other issues, your best bet will be turning up your error logging, and tailing the relevant log file. Your apache error_log may be a good place to start.

Also consider running php -l to detect parse-time errors (runtime errors still won't turn up until runtime, however)

Improve this answer

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.