PHP and SQL: managing log-in via databases - php

Question

I'm creating a website which has a section dedicated to reviews and another one dedicated to users (log-in and sign up), both managed via databases.
In the reviews section, a user can give a review (via a form) which is uploaded in the database using this PHP code
<?php
if(isset($_POST['pulsanteRecensione']))
{
$host = "localhost";
$username = "root";
$password = "root";
$db_nome = "ristorante";
$tab_nome = "recensioni";
$link = mysqli_connect($host, $username) or die ('Impossibile connettersi: '.mysqli_error());
mysqli_select_db($link, $db_nome) or die ('Accesso non riuscito');
$nome = $_POST['nome'];
$recensione = $_POST['recensione'];
$sql = "INSERT INTO $tab_nome (`Nome`, `Recensione`) VALUES ('$nome', '$recensione')";
if(mysqli_query($link, $sql))
{
echo "<h4 align=\"center\">Inserimento avvenuto con successo</h4>";
}
else
{
echo "<h4 align=\"center\">Spiacenti, inserimento non riuscito</h4>";
}
}
?>
and it works. In the same way, I want to manage the users section, so I tried this PHP code for signing up that is more or less the same as the previous one
<?php
if(isset($_POST['effettuaRegistrazione']))
{
$nome = $_POST['nome'];
$cognome = $_POST['cognome'];
$mail = $_POST['email'];
$password = $_POST['password'];
$data = $_POST['dataNascita'];
$citta = $_POST['citta'];
$host = "localhost";
$username = "root";
$password = "root";
$db_nome = "ristorante";
$tab_nome = "utenti";
$link = mysqli_connect($host, $username) or die ('Impossibile connettersi: '.mysqli_error());
mysqli_select_db($link, $db_nome) or die ('Accesso non riuscito');
$sql = "INSERT INTO $tab_nome (`ID_Utente`, `Cognome`, `Nome`, `E-mail`, `Password`, `Data di nascita`, `Citta`) VALUES ('3','$cognome','$nome','$mail','$password','$data','$citta')";
if(mysqli_query($link, $sql))
{
echo "<h4 align=\"center\">Inserimento avvenuto con successo</h4>";
}
else
{
echo "<h4 align=\"center\">Spiacenti, inserimento non riuscito</h4>";
}
}
?>
but it doesn't work, it always shows Spiacenti, inserimento non riuscito. What am I doing wrong?
Here there is the structure of the utenti table

Answer 1

For one thing, you have an AI'd column (auto_increment).
You need to replace 3 in '3' with '' in VALUES.
mysqli_error($link) on the query would have signaled the error.
You also shouldn't be storing plain text passwords or as integers (see my note about that further down).
Use password_hash() and a prepared statement as you are open to an SQL injection here.
Use error reporting in case your POST arrays fail.
http://php.net/manual/en/function.error-reporting.php
However, your $link = mysqli_connect($host, $username) and mysqli_select_db($link, $db_nome) may be failing here.
Use all four arguments for it and if there is no password for the db required, use '' only.
I.e.:
$link = mysqli_connect($host, $username, '', $db_nome);
If your present method works, then disregard that ^
Another thing; the password column as an int(15), that doesn't seem to make much sense and it is not a secure method.
Password columns are usually varchar and using a minimum 60 length to save a safe hash, such as password_hash(); the manual on password_hash() says that 255 is a good bet.
Also, mysqli_error() requires a db connection for it mysqli_error($link).
You also need to make sure that the columns' lengths are long enough to hold the data. That in itself could fail silently or truncated.
Note:
Your entire code's execution is relying on this conditional statement:
if(isset($_POST['effettuaRegistrazione'])) {...}
If that fails, so will your entire query.
Plus, as stated in comments (by Jeff):
You're using the same variable for $password for both the POST array and the possible password for your db login; you need to change one of those.