Rights INSERT PHPmyadmin MySQL - php

Question

I have setup a basic table and connected a PHP file with the database. I can fetch data from the database by using SELECT. However, when I try to use UPDATE or INSERT INTO, I get the message:
"INSERT command denied to user ''#'localhost' for table 'table_data'".
When I try to use the query in PMA, i am able to insert data. But when i want to adjust user rights, it says i don't have the rights to do so. But when i use the SQL SHOW GRANTS, i receive:
"Grants for xxx#10.0.% GRANT USAGE ON . TO 'xxxl'#'10.0.%'
IDENTIFIED BY PASSWORD GRANT ALL PRIVILEGES ON
'database_name'.* TO 'xxx'#'10.0.%' WITH GRANT OPTION.
I am using the only MySQL account provided by my host so I assume it is the root user.
$servername = "mysql.domain_name.nl";
$username = 'xxx';
$password = 'xxx';
$conn = new mysqli($servername, $username, $password);`
$username = $_POST['username'];
$password = $_POST['password'];
$query = "INSERT INTO 'game'.'login_data' ('username', 'password') VALUES ('".$username."', '".$password."')";
$data = mysql_query ($query)or die(mysql_error());
Please help me to gain rights to be able to INSERT.

Answer 1

First you need to read up on using mysqli. Everything you need is here: http://php.net/manual/en/book.mysqli.php
You will see that you are missing 1 parameter from your $conn
Needs to be new mysqli('localhost', 'my_user', 'my_password', 'my_db');
$servername = "mysql.domain_name.nl";
$username = 'xxx';
$password = 'xxx';
$conn = new mysqli($servername, $username, $password, **add database**);
$username = $_POST['username'];
$password = $_POST['password'];
For the sake of security you want to use prepared statements.
Change it to the following:
if ($stmt = $conn->prepare("INSERT INTO `game`.`login_data` (username, password) VALUES (?, ?)")) {
$stmt->bind_param('ss', $username , $password );
// Execute the prepared query.
if (! $stmt->execute()) {
$stmt->close();
}
}
}
Of course this is not the way you should completely treat a user database. You want to be hashing passwords, storing salts etc. But for this question. The above should be enough.

Answer 2

I have tidied up your code, fixed the syntax errors, as well as switched the entire code to PDO.
MySQL is deprecated and MySQLi is open to SQL injection hacks, even with mysqli_real_escape_string!
<?php
$user = 'xxx';
$pass = 'xxx';
$conn = new PDO('mysql:host=localhost;dbname=mysql.domain_name.nl', $user, $pass);
$username = $_POST['username'];
$password = $_POST['password'];
$stmt = $conn->prepare("INSERT INTO `game`.`login_data` ('username', 'password') VALUES (:username, :password)");
$stmt->bindParam(':username', $username);
$stmt->bindParam(':password', $password);
$stmt->execute();
?>
For more information on PDO, consult the manual here: http://php.net/manual/en/book.pdo.php