Home/ Questions/Q 8544627
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-11T12:36:23+00:00

Possible Duplicate: why cant i insert data into my sql db with php well,

  • 0

Possible Duplicate:
why cant i insert data into my sql db with php

well, in a nutshell i am writting a login form that stores data into a database. my html and script should be working perfectly, without too much regards to security at this exact moment in time. but the problem i have is my php script WILL NOT update my sql db. everything checks out fine, all post variables are carried over it just will not insert them. im staring to think that the user(yes i am using root) does not have sufficient privelleges for some reason, so i was wondering how to go about setting up a new “admin user” if you will. im running WAMP on my windows 7 machine ifthat makes a huge difference.

my form:

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Registration</title>
</head>

<body>

<form action="register.php" method="post" />
<p>Username:</p><input type="text" name="username" />
<p>Password:</p><input type="text" name="password" />
<p>Name:</p><p>First:<input type="text" name="fname" />Last:<input type="text" name="lname" /></p>
<p>Email:</p><input type="text" name="email" />
<input type="submit" />

</body>
</html>

my script:

<?php

$host="localhost"; // Host name 
$username="root"; // Mysql username 
$password=""; // Mysql password 
$db_name="login"; // Database name 
$tbl_name="members"; // Table name 

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

// username and password sent from form 
$myusername=$_POST['username']; 
$mypassword=$_POST['password']; 
$myfname=$_POST['fname'];
$mylname=$_POST['lname'];
$myemail=$_POST['email'];



// To protect MySQL injection 
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);
$sql="SELECT * FROM $tbl_name WHERE username='$myusername'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);

// If result matched $myusername and $mypassword, table row must be 1 row
if($count==1){

// username taken
echo "Username already taken";
exit();
}

//protection against sql injection
if (get_magic_quotes_gpc())
{
function stripslashes_deep($value)
{
$value = is_array($value) ?
array_map(stripslashes_deep, $value) :
stripslashes($value) ;
return $value;
}
$_POST = array_map(stripslashes_deep, $_POST);
$_GET = array_map(stripslashes_deep, $_GET);
$_COOKIE = array_map(stripslashes_deep, $_COOKIE);
$_REQUEST = array_map(stripslashes_deep, $_REQUEST);
}

//insert form into DB members




'INSERT INTO members SET
username="' . $myusername . '",
password="' . $mypassword . '",
fname="' . $myfname . '",
lname="' . $mylname . '"
email="' . $myemail . '"';

session_register("myusername");
session_register("mypassword"); 
header("location:registersuccess.html");
?>

sql commands used to create table:

use login
>database changed
CREATE TABLE members(
id INT(4) NOT NULL AUTO_INCREMENT PRIMARY KEY,
username VARCHAR(30) NOT NULL,
password VARCHAR(30) NOT NULL,
fname VARCHAR(30) NOT NULL,
lname VARCHAR(30) NOT NULL,
email VARCHAR(30) NOT NULL
)
;

i can then add a user update from the comand line, but php is a no go, again using root acount with a password. the script does connect to the server, because it does succesfully check if the user all ready exists or not. if any more info is needed, please just ask.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    1) Firstly, don’t use the old mysql_* functions, they are insecure and depreciated (see the red box here). Instead look at using PDO or MySQLi, they don’t take long to learn and are, imho, much better in every regard, including ease of use once you’re used to them.

    2) Secondly, SET is mainly used for UPDATE commands, not commonly used for INSERT. An INSERT command should usually look something like;

    INSERT INTO `tbl` (`column1`,`column2`) VALUES ('value1','value2');

    See MySQL manual.

    3) Thirdly, I’m not sure if the code has copied incorrectly but it doesn’t look like you’ve assigned the following insert string to a variable, nor executed it?

    'INSERT INTO members SET
username="' . $myusername . '",
password="' . $mypassword . '",
fname="' . $myfname . '",
lname="' . $mylname . '"
email="' . $myemail . '"';

    (again see point 2. about the syntax).

    4) Fourthly, indentation!! Makes for a lot easier reading and also debugging. Properly indented code can show you errors just by reading the code, before even starting proper ‘debugging’ procedure which can save you a LOT of time! 🙂

    • 0