Question

I have a form that e-mails the form data to a e-mail address. I am also wanting to store this information into a database. The problem I am running into is I am pulling information from one table, online_rental_db so that the information from that can be sent to us. I am wanting to also store the form information into another table online_rental_request.

<?php

$rentID = $_POST['current_id'];

$db=mysql_connect ("localhost","test","test") or die(mysql_error());
mysql_select_db("rentals");

$table="online_rental_db";
$sql = "SELECT * FROM $table WHERE ID=$rentID";
$query = mysql_query($sql) or die(mysql_error());
$rentals = mysql_fetch_assoc($query);
$description = ucwords(strtolower($rentals['Description']));
$image = $rentals['Image'];
$download = $rentals['PDF'];
$bytes =  filesize($rentals['PDF']);
$ID = $rentals['ID'];
$CTGID = $rentals['CTGID'];
$category = $rentals['Category'];
$model = $rentals['model'];

I have tried using on the $sql to do

$sql = "SELECT * FROM $table WHERE ID=$rentID INSERT INTO online_rental_request (name, email, id, description, model, category) VALUES ('$_POST[name]','$_POST[email]','$rentID','$description','$model','$category')";

but it gives me a sql error!

Answer 1

If you mean to insert into the online_rental_request table directly from online_rental_db table, you should do the following:

$name = mysql_escape_string($_POST['name']);
$email = mysql_escape_string($_POST['email']);
$sql = "INSERT INTO online_rental_request (name, email, id, description, model, category) SELECT '$name', '$email', id, description, model, category FROM $table WHERE ID=$rentID";

By the way, you should not forget to escape your user-submitted values. You should do this:

$rentID = mysql_escape_string($_POST['current_id']);

OR, better
$rentID = (int)$_POST[‘current_id’];