Question

I want to make a 2 field input form to my MySQL database. I connect to the database with no problem and even can post if I want, but the form is giving an error. (I’m already connected to the database at this point and I can test that is working)

This is the form:

<form action="insert.php" method="post">
Title: <input type="text" name="title" />
Privacy: <select type="text" name="privacy" />
  <option value="public">Publico</option>
  <option value="private">Privado</option>
</select>
<input type="submit" />
</form>

This is the insert.php file:

<?  
mysql_select_db("copoetry", $con);
$sql="INSERT INTO Poems (Title, Privacy)
VALUES
('$_POST[title]','$_POST[privacy]')";

if (!mysql_query($sql,$con))
  {
  die('Error: ' . mysql_error());
  }
echo "1 record added";
mysql_close($con)
?>

When I press submit I get this error:

Warning: mysql_select_db(): supplied argument is not a valid MySQL-Link resource in /home/content/02/6945202/html/copoetry/insert.php on line 2

Warning: mysql_query(): supplied argument is not a valid MySQL-Link resource in /home/content/02/6945202/html/copoetry/insert.php on line 7
Error:

What am I doing wrong? Thanks

Answer 1

Your $con variable should hold a connection to the database with mysql_connect();, you appear to removed this line at some point.

EG:

$con = mysql_connect('host', 'user', 'pass') or die(mysql_error());

Once you have done this successfully all your mysql_* calls will use that connection, so you could get rid of the $con variable anyway.

ALSO
Don’t forget to escape your inputs so that are safe, inserting a $_POST, $_GET or $_REQUEST variable straight into mysql is very unsafe. Make at the very least you run mysql_real_escape_string(); on each and every input you get from a form or cookie.

EG

// Create a shortcut function somewhere early in your script
function mes($input) { 
    return mysql_real_escape_string($input);
}

// SQL Example
$sql = "INSERT INTO Poems (Title, Privacy) VALUES ('".mes($_POST['title'])."','".mes($_POST['privacy'])."')";

Note the string concatenation (using fullstop) to separate the strings/variables.