Question

Cannot find the bug here, think so this whole script is fagged up, still can not see any signs of success as such.
The problem is when the form is hit with the specified details i.e. username , password and an e-mail address are not inserted into mysql database and I am unable to verify through PHP “How to check if details are present in database?”.

   <?php
    ob_start();
    $host="localhost"; // Host name 
    $username="root"; // Mysql username 
    $password=""; // Mysql password 
    $db_name="cosmos"; // Database name 
    $tbl_name="members"; // Table name

    // Connect to server and select databse.
    mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
    mysql_select_db("$db_name")or die("cannot select DB");




    // Define $myusername and $mypassword and $mail
    $user=$_POST['myusername'];
    $pass=$_POST['mypassword'];
    $user = stripslashes($user);
    $pass = stripslashes($pass);
    $user = mysql_real_escape_string($user);
    $pass = mysql_real_escape_string($pass);
    $pass = md5($pass);
    $mail=$_POST['email'];

    $sql = "INSERT INTO `cosmos`.`members` (`id`, `username`, `password`, `email id`) VALUES (NULL, \'$user\', \'$pass\', \'$mail\'), (NULL, \'\', \'\', \'\');";
    $result=mysql_query($sql);
    echo "Pass!"; //dont know how to verify :)
    ob_end_flush();
    ?>

can you please correct this or give a new one , thanks in advance!

Answer 1

You shouldn’t escape the single quotes:

$sql = "INSERT INTO `cosmos`.`members` (`username`, `password`, `email id`) VALUES ('$user', '$pass', '$mail');";

Also don’t forget to do this:

$mail = mysql_real_escape_string($_POST['email']);