Home/ Questions/Q 8706627
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-13T03:39:36+00:00

I have a single field post of the form: <form action=post.php method=post> <input type=text

  • 0

I have a single field post of the form:

<form action="post.php" method="post">
<input type="text" name="foo" />

I am trying to insert foo into a small mySql table named 'datatable' in the database 'mydatabase' in post.php.

This string works for me to add a data row in my table:

mysql_query('INSERT INTO 'mydatabase'.'datatable' ('data') VALUES (\'testabc\');');

So I know my connection string is working. However, I cannot figure out how to insert the actual post data ($_POST['foo']) into my table. I have tried strings such as:

mysql_query('INSERT INTO 'mydatabase'.'datatable' ('data') VALUES (\'' + $_POST['foo'] + '\');');

But cannot figure out the correct syntax to make this work. Can any of you brilliant minds help hint me in the right direction?

Many thanks…

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    PHP uses . for concatenation, not +.

    However, you really shouldn’t use mysql_*. I highly suggest PDO. It’s simple to use and will protect you from injection (to which you are currently vulnerable). You may also need to consider that magic quotes is enabled so stripslashes on the post data may be appropriate. trim. usually is as well.

    • 0