Trouble getting FORM submitted to Mysql - php

Question

I have one page which has one input text box and that data needs to be either inserted or updating the existing row.
I will echo it later, that is under control.
<form method="post" name="tapahtuma">
Submit:
<input type="text" name="auts[]">
<input type="button" value="Ilmoita">
</form >
<?php
if(isset( $_POST["tapahtuma"]) ) {
$link = mysql_connect("localhost","root","","db");
mysqli_query($link, "INSERT INTO table (column) VALUES ('".$auts."')");
$auts = mysql_real_escape_string($_POST['auts']);
mysqli_close($link);
}
?>

Answer 1

According to the code provided.
Changes
Change <input type="button" value="Ilmoita"> to <input type="submit" name="Ilmoita" value="Ilmoita">
Change if(isset( $_POST["tapahtuma"]) ) { to if(isset( $_POST["Ilmoita"]) ) {
Change $link = mysql_connect("localhost","root","","db"); to $link = mysqli_connect("localhost","root","","db");
Put $auts = mysql_real_escape_string($_POST['auts']); before mysqli_query
Updated Code
<form method="post" name="tapahtuma">
<input type="text" name="auts">
Submit: <input type="submit" name="Ilmoita" value="Ilmoita">
</form >
<?php
if(isset( $_POST["Ilmoita"]) ) {
$link = mysqli_connect("localhost","root","","db");
$auts = mysql_real_escape_string($_POST['auts']);
mysqli_query($link, "INSERT INTO table (column) VALUES ('".$auts."')");
mysqli_close($link);
}?>
I will suggest you to use prepared statements to avoid SQL Injections
<form method="post" name="tapahtuma">
<input type="text" name="auts">
Submit: <input type="submit" name="Ilmoita" value="Ilmoita">
</form>
<?php
if(isset($_POST["Ilmoita"])) {
$link = mysqli_connect("localhost","root","","db") or die("connection failed: " . mysqli_connect_error());
$result = mysqli_prepare($link, "INSERT INTO `table` (`column`) VALUES (?)");
mysqli_stmt_bind_param($result, "s", $_POST['auts']);
mysqli_stmt_execute($result);
mysqli_close($link);
}?>
Quick Links
mysqli_prepare
How can I prevent SQL injection in PHP?

Answer 2

<form method="post" name="tapahtuma">
Vapaa teksti: <input type="text" name="auts">
<input type="submit" value="ilmoita" name="ilmoita">
</form >
<?php
if(isset( $_POST["ilmoita"]) ) {
$link = mysqli_connect("localhost","root","","db");
$auts = mysqli_real_escape_string($link, $_POST['auts']);
mysqli_query($link, "INSERT INTO table (column) VALUES ('$auts')");
mysqli_close($link);
}?>
What I did, is that I used mysqli_real_escape_string instead of mysql_real_escape_string and also added the $link there as well.
I will test with the prepared statements sometime, but at least this works and it really isn't a concern with the sqli exploits.