Inserting HTML form data comes up blank - php

Question

I am trying to send info I enter into an HTML form, into a MySQL database table. The function works, BUT...It enters BLANK data into the Mysql Database
I dont know what else to try. I am really new to this
THIS IS MY HTML FORM:
<form action="" method="post">
<div class="form-group">
<label for="date">Date</label>
<input type="date" class="form-control" id="date" aria-describedby="emailHelp" placeholder="Date">
<small id="emailHelp" class="form-text text-muted">The date the team went to the job site</small>
</div>
<div class="form-group">
<label for="job_number">Job Number</label>
<input type="text" class="form-control" id="job_number" placeholder="JC2020">
</div>
<div class="form-group">
<label for="job_name">Job Name</label>
<input type="text" class="form-control" id="job_name" placeholder="AVI Tender">
</div>
<div class="form-group">
<label for="team_name">Team Name</label>
<input type="text" class="form-control" id="team_name" placeholder="Shane">
</div>
<div class="form-group">
<label for="pastel_code">Pastel Code</label>
<input type="text" class="form-control" id="pastel_code" placeholder="012">
</div>
<div class="form-group">
<label for="vrn">Vehicle Registration</label>
<input type="text" class="form-control" id="vrn" placeholder="ND 123-456">
</div>
<button type="submit" class="btn btn-primary">Submit</button>
</form>
THIS IS MY PHP file that processes the data:
<?php
require_once('config.php');
$date= $_POST['date'];
$job_number= $_POST['job_number'];
$team_name= $_POST['team_name'];
$pastel_code= $_POST['pastel_code'];
$vrn= $_POST['vrn'];
$job_name= $_POST['job_name'];
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$sql = "INSERT INTO job_records (date, job_number, team_name, pastel_code, vrn, job_name)
VALUES ('$date', '$job_number', '$team_name', '$pastel_code', '$vrn', '$job_name')";
$conn->exec($sql);
echo "<script>alert('Data successfully added!'); window.location='dataentry.php'</script>";
?>
After submitting the form, a message displays saying the data was added, then redirects to the "master data" page with ALL the entries i have entered over time. But all entries i process come out BLANK. What am i doing wrong?

Answer 1

As I mentioned each form element requires a name attribute in order that it will appear in the POST array when the form is submitted. An ID attribute is mainly of use when interacting with the DOM using Javascript so really are not required below / above.
<form action='' method='post'>
<div class='form-group'>
<label for='date'>Date</label>
<input type='date' class='form-control' id='date' name='date' aria-describedby='emailHelp' placeholder='Date'>
<small id='emailHelp' class='form-text text-muted'>The date the team went to the job site</small>
</div>
<div class='form-group'>
<label for='job_number'>Job Number</label>
<input type='text' class='form-control' id='job_number' name='job_number' placeholder='JC2020'>
</div>
<div class='form-group'>
<label for='job_name'>Job Name</label>
<input type='text' class='form-control' id='job_name' name='job_name' placeholder='AVI Tender'>
</div>
<div class='form-group'>
<label for='team_name'>Team Name</label>
<input type='text' class='form-control' id='team_name' name='team_name' placeholder='Shane'>
</div>
<div class='form-group'>
<label for='pastel_code'>Pastel Code</label>
<input type='text' class='form-control' id='pastel_code' name='pastel_code' placeholder='012'>
</div>
<div class='form-group'>
<label for='vrn'>Vehicle Registration</label>
<input type='text' class='form-control' id='vrn' name='vrn' placeholder='ND 123-456'>
</div>
<button type='submit' class='btn btn-primary'>Submit</button>
</form>
That said the main issue, which has been addressed in comments, is that of SQL injection vulnerabilities - one of the benefits of both PDO and mySQLi are prepared statements. As you are using PDO perhaps this might be of use:
<?php
if( $_SERVER['REQUEST_METHOD']=='POST' ){
require_once('config.php');
$args=array(
'date' => FILTER_SANITIZE_STRING,
'job_number' => FILTER_SANITIZE_STRING,
'team_name' => FILTER_SANITIZE_STRING,
'pastel_code' => FILTER_SANITIZE_STRING,
'vrn' => FILTER_SANITIZE_STRING,
'job_name' => FILTER_SANITIZE_STRING
);
$_POST=filter_input_array( INPUT_POST, $args );
$params=array();
$sql='insert into `job_records` ( `date`, `job_number`, `team_name`, `pastel_code`, `vrn`, `job_name` ) values ( :date, :job_number, :team_name, :pastel_code, :vrn, :job_name )';
foreach( array_keys( $args ) as $key ){
$params[ ':'.$key ] = ${$key};
}
$stmt=$conn->prepare( $sql );
$res = $stmt->execute( $params );
exit( header( sprintf( 'Location: dataentry.php?status=%s', $res ? 'ok' : 'fail' ) ) );
}
?>
demo - tested and appears to function OK
<?php
if( $_SERVER['REQUEST_METHOD']=='POST' ){
try{
/* PDO connection */
$dbport = 3306;
$dbhost = 'localhost';
$dbuser = 'root';
$dbpwd = 'xxx';
$dbname = 'xxx';
$options=array(
PDO::ATTR_CURSOR => PDO::CURSOR_SCROLL,
PDO::ATTR_PERSISTENT => false,
PDO::MYSQL_ATTR_USE_BUFFERED_QUERY => true,
PDO::ATTR_EMULATE_PREPARES => true,
PDO::MYSQL_ATTR_INIT_COMMAND => 'SET NAMES \'utf8mb4\' COLLATE \'utf8mb4_unicode_ci\', ##sql_mode = STRICT_ALL_TABLES, ##foreign_key_checks = 1'
);
$dsn='mysql:host='.$dbhost.';port='.$dbport.';dbname='.$dbname.';charset=UTF8';
$db = $conn = new PDO( $dsn, $dbuser, $dbpwd, $options );
/* disabled as not relevant in demo */
#require_once('config.php');
$args=array(
'date' => FILTER_SANITIZE_STRING,
'job_number' => FILTER_SANITIZE_STRING,
'team_name' => FILTER_SANITIZE_STRING,
'pastel_code' => FILTER_SANITIZE_STRING,
'vrn' => FILTER_SANITIZE_STRING,
'job_name' => FILTER_SANITIZE_STRING
);
$_POST=filter_input_array( INPUT_POST, $args );
extract( $_POST );
$errors=array();
$params=array();
$keys=array_keys( $args );
/* dynamically build sql query from $args array */
$sql=sprintf('insert into `job_records`
( `%s` )
values
( :%s ) ',
implode( '`,`', $keys ),
implode( ', :', $keys )
);
/* check that each variable is set else throw exception and continue */
foreach( array_keys( $args ) as $key ){
try{
/* test variable variable against those generated by `extract` above */
if( empty( ${$key} ) ) throw new Exception( sprintf( 'empty field: %s', $key ) );
/* add the parameter to the args to be executed */
$params[ ':'.$key ] = ${$key};
}catch( Exception $e ){
$errors[]=$e->getMessage();
continue;
}
}
/* If all went well execute the query & redirect user */
if( !empty( $params ) && empty( $errors ) && !empty( $conn ) ){
$stmt=$conn->prepare( $sql );
if( !$stmt ) throw new PDOException('Failed to prepare SQL Query');
$res = $stmt->execute( $params );
exit( header( sprintf( 'Location: dataentry.php?status=%s', $res ? 'ok' : 'fail' ) ) );
}
if( !empty( $errors ) ) printf( '<pre>%s</pre>', print_r($errors,true) );
}catch( PDOException $e ){
exit( $e->getMessage() );
}
}
?>
<!DOCTYPE html>
<html lang='en'>
<head>
<meta charset='utf-8' />
<title>PDO form test</title>
</head>
<body>
<form action='' method='post'>
<div class='form-group'>
<label for='date'>Date</label>
<input type='date' class='form-control' id='date' name='date' aria-describedby='emailHelp' placeholder='Date'>
<small id='emailHelp' class='form-text text-muted'>The date the team went to the job site</small>
</div>
<div class='form-group'>
<label for='job_number'>Job Number</label>
<input type='text' class='form-control' id='job_number' name='job_number' placeholder='JC2020'>
</div>
<div class='form-group'>
<label for='job_name'>Job Name</label>
<input type='text' class='form-control' id='job_name' name='job_name' placeholder='AVI Tender'>
</div>
<div class='form-group'>
<label for='team_name'>Team Name</label>
<input type='text' class='form-control' id='team_name' name='team_name' placeholder='Shane'>
</div>
<div class='form-group'>
<label for='pastel_code'>Pastel Code</label>
<input type='text' class='form-control' id='pastel_code' name='pastel_code' placeholder='012'>
</div>
<div class='form-group'>
<label for='vrn'>Vehicle Registration</label>
<input type='text' class='form-control' id='vrn' name='vrn' placeholder='ND 123-456'>
</div>
<button type='submit' class='btn btn-primary'>Submit</button>
</form>
</body>
</html>

Answer 2

Your code is correct but the error create on your input field
In simple and short use name(Attribute) on the input field and pass that name to save the data.
<form action="insert.php" method="post">
<p>
<label for="firstName">First Name:</label>
<input type="text" name="first_name" id="firstName">
</p>
<p>
<label for="lastName">Last Name:</label>
<input type="text" name="last_name" id="lastName">
</p>
<p>
<label for="emailAddress">Email Address:</label>
<input type="text" name="email" id="emailAddress">
</p>
<input type="submit" value="Submit">
</form>
Retrive form value and insert in to database
<?php
/* Attempt MySQL server connection. Assuming you are running MySQL
server with default setting (user 'root' with no password) */
$link = mysqli_connect("localhost", "root", "", "demo");
// Check connection
if($link === false){
die("ERROR: Could not connect. " . mysqli_connect_error());
}
// Escape user inputs for security
$first_name = mysqli_real_escape_string($link, $_REQUEST['first_name']);
$last_name = mysqli_real_escape_string($link, $_REQUEST['last_name']);
$email = mysqli_real_escape_string($link, $_REQUEST['email']);
// Attempt insert query execution
$sql = "INSERT INTO persons (first_name, last_name, email) VALUES ('$first_name', '$last_name', '$email')";
if(mysqli_query($link, $sql)){
echo "Records added successfully.";
} else{
echo "ERROR: Could not able to execute $sql. " . mysqli_error($link);
}
// Close connection
mysqli_close($link);
?>
Conclusion for your code error
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$sql = "INSERT INTO job_records ('database column name with comma seperated')
VALUES ('Input variable value seperated by comma')";