Question

I’m sure this is pretty elementary but I’m new to php. Can someone tell me why this code won’t write to the table? I just simply want the form to update a table in the db. Everthing works except the data in the table is not being overwritten. Any help would be greatly appreciated! Thanks.

<?php
$username="username";
$password="password";
$dbname="database";
$usertable="table";
$connect = @mysql_connect($hostname, $username, $password)or die
("cannot connect to db");
mysql_select_db($dbname);

$show=$_POST['show'];
$pro=$_POST['pro'];
$twmo=$_POST['twmo'];


mysql_query("INSERT INTO $usertable VALUES
('$show','pro','$twmo')" );

mysql_close($connect);
header("Location: http://www.myhomepage.com");

?>

Answer 1

First,

• Your code is vulnerable to SQL injections.
  A malicious user could easily wipe out your entire table.
• You shouldn’t even be using mysql_*!
  It’s deprecated and bad style! Go find a tutorial for mysqli or PDO, don’t relay on articles from 2008.

Regarding the actual question, try some debugging yourself. You’re not checking if any of your queries succeed. When you perform a query, mysql_query() returns either a resource or FALSE on failure. Check if this is happening, so you can find out where exactly the error is happening and what it is using mysql_error().

If your table is actually called table, then that’s the problem. table is a reserved keyword. You could fix it by encapsulating it with ticks `, but really you should just change its name. It isn’t useful at all to have a table named table. Call it what it contains.