Question

I have PHP query to a MSSQL Database. It Looks like this:

<?php 

    if (isset($_POST['form6'])) {
        $Title=$_POST['Title'];
        $Synopsis=$_POST['Synopsis'];
        $Article=$_POST['Article'];
        $DateUploaded= date("Y-m-d H:i:s");
        $Deleted=$_POST['Deleted'];

        $myServer = "**********";
        $myUser = "**********";
        $myPass = "******";
        $myDB = "*********";

        $dbhandle = mssql_connect($myServer, $myUser, $myPass) or die("Couldn't connect to SQL Server on $myServer"); 
        mssql_select_db($myDB) or die;

        $dbTABLE = "Tablename";
        $query_sql = sprintf("INSERT INTO %s (Title, Synopsis, Article, DateUploaded, Deleted)   VALUES ('%s','%s','%s','%s','%s')",
        addslashes($dbTABLE),
        addslashes($Title),
        addslashes($Synopsis),
        addslashes($Article),
        addslashes($DateUploaded),
        addslashes($Deleted));

        if ($result = mssql_query($query_sql, $dbhandle)) {
            print "Your information has been successfully added to the database.";
            header('Location: News.php');
        }
    }
?>

Originally it was on a seperate .php file and got executed on the ‘action’ of the form. However to lessen the amount of redirects I moved it to the same page as the form and included that if statement at the top, to try and get it to execute on post of the form, which is named form6.

here is the form line.:

<FORM method="post" name="form6" id="form6" ENCTYPE="multipart/form-data" action="<?php echo $_SERVER['PHP_SELF']; ?>">

However all this seems to do is refesh the page, and no data is addded to the database and it does not hit the header to redirect to News.php.

I also tried it with no action, same result. My question is why doesn’ this make it hit the php function/query?

Answer 1

You are checking the <form element which never actually has values in it in the line:

if (isset($_POST['form6']))

You need to check the actual form elements (inputs) to see if data is sent.

You should be checking the actual values in the likes of $_POST['Title'] to see if data has been sent from the form.

If you want to include the form name, use a hidden field like this inside the form:

<input type='hidden' name='form6' value='1'>