Question

When I submit guestbook details via php form, it ends with “Successful”, but when I look at MySQL database, it just creates new entry, but no details are present expect the automatic ID and date.

Here’s the form: guestbook.php

 <form id="form1" name="form1" method="post" action="addguestbook.php">
 <td><input name="name" type="text" id="name" size="40" /></td>
 <td><input name="email" type="text" id="email" size="40" /></td>
 <td><textarea name="comment" cols="40" rows="3" id="comment"></textarea></td>
 <td><input type="submit" name="Submit" value="Submit" /> <input type="reset" 
 name="Submit2" value="Reset" /></td>

Here’s the script: addguestbook.php

 $host="address"; // Host name 
 $username="username"; // Mysql username 
 $password="password"; // Mysql password 
 $db_name="guestdb"; // Database name 
 $tbl_name="guestbook"; // Table name 

// Connect to server and select database.
 mysql_connect("$host", "$username", "$password")or die("cannot connect server "); 
 mysql_select_db("$db_name")or die("cannot select DB");

 $datetime=date("y-m-d h:i:s"); //date time

 $sql="INSERT INTO $tbl_name(name, email, comment, datetime)VALUES('$name', '$email',     
'$comment', '$datetime')";
 $result=mysql_query($sql);

//check if query successful 
 if($result){
 echo "Successful";
 echo "<BR>";

// link to view guestbook page
 echo "<a href='viewguestbook.php'>View guestbook</a>";}

 else {
 echo "ERROR";}
 mysql_close();

Answer 1

That I can see, you havn’t defined your variables.. Add this above $datetime=da....

$name = isset($_POST['name']) ? $_POST['name'] : false;
$email = isset($_POST['email']) ? $_POST['email'] : false;
$comment = isset($_POST['comment']) ? $_POST['comment'] : false;

In addition to this:

• Please use mysqli_* queries or PDO
• Use mysql*_real_escape_string to create a legal SQL string