Data not inserting into database - php

Question

I am trying to insert into database the form data but it is not working, I have added the code below. Please check and inform me what the problem is. As the deletion and search queries are working but insertion is the only query that are not working. Thanks
<form method="post" action= "assign5.php">
Name : <input type ="text" name="name" >
<br>
Flavor : <select name="flavor">
<option value="Chocolate">Chocolate</option>
<option value="Vanilla">Vanilla</option>
<option value="Strawberry">Strawberry</option>
<option value="MahngiVanilla">MahngiVanilla</option>
<option value="SastiStrawberry">SastiStrawberry</option>
</select>
<br>
Scoops:
<input type ="radio" name="scoops" value="1">1</input>
<input type ="radio" name="scoops" value="2">2</input>
<input type ="radio" name="scoops" value="3">3</input>
<input type ="radio" name="scoops" value="4">4</input>
<input type ="radio" name="scoops" value="5">5</input>
<input type ="submit" name="button" value="Place Order"/>
<br>
<br>
</form>
<?php
require_once 'login.php';
$connection = new mysqli($db_hostname,$db_username,$db_password,$db_database);
if($connection ->connect_error) die($connection ->connect_error);
if(isset($_POST['name']) && isset($_POST['Flavour']) && isset($_POST['Scoops']) ){
$CName=$_POST['name'];
$Flavor=$_POST['flavor'];
$Scoops=$_POST['scoops'];
$sql ="INSERT INTO orders VALUES (CName, Flavour, Scoops) VALUES ('$CName', '$FLAVOUR', '$Scoops')";
$result=$connection->query($sql);
if(!$result) die($connection->error);
header("Location: assign5.php");
}
$connection->close();
?>

Answer 1

You must have to provide name, flavour & scopps from form. Even you provided but still your query does not work. Because your input key at form is small letter and you checking it at condition using Capital letter of first character. So try it
if(isset($_POST['name']) && isset($_POST['flavour']) && isset($_POST['scoops']) ){
.....
.....
}
You used Values in two times. Please correct this from
$sql ="INSERT INTO orders VALUES (CName, Flavour, Scoops) VALUES ('$CName', '$FLAVOUR', '$Scoops')";
To:
$sql ="INSERT INTO orders (CName, Flavour, Scoops) VALUES ('$CName', '$FLAVOUR', '$Scoops')";

Answer 2

As you are not sanitizing user input nor are you using prepared statements you could simply do the following and avoid the spelling / capitalisation errors:
$sql ="INSERT INTO orders (CName, Flavour, Scoops)
VALUES
('{$_POST['name']}', '{$_POST['flavor']}', '{$_POST['scoops']}')";
Also, the use of values before the field/column names was incorrect - it comes after the column names!
Note: It would be far, far better to use prepared statements however!
Untested example of prepared statements for this use case would be perhaps:
$sql = 'insert into `orders` (`cname`,`flavour`,`scoops`)' values(?,?,?);
$stmt = $connection->prepare( $sql );
if( $stmt ){
$name=$_POST['name'];
$flavour=$_POST['flavor'];
$scoops=intval( $_POST['scoops'] );
$stmt->bind_param('ssi',$name,$flavour,$scoops);
$result = $stmt->execute();
echo $result ? 'OK' : 'Bad Foo!';
}